Détails IP 45.79.192.232

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « teradata_probe » (signaux protocolaires) · confiance 0%

Confiance 0 % — 5 signal(aux) capteur

Comparaison ASN / FAI

ASN 63949 · 45.79.192.0/19 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 7 événements sur la période pour cette IP.

192.46.221.91 Cross-site scripting 21/07/2026 20:50 UTC
45.79.152.240 rtcp 21/07/2026 20:29 UTC
172.105.208.132 Sonde PPTP 21/07/2026 19:49 UTC
172.236.228.208 Sonde PostgreSQL 21/07/2026 19:34 UTC
172.105.128.11 Sonde PostgreSQL 21/07/2026 18:51 UTC
45.79.172.21 Sonde PostgreSQL 21/07/2026 18:39 UTC
45.79.40.217 upnp-ssl 21/07/2026 18:07 UTC
172.238.246.191 Botnet Mozi 21/07/2026 16:18 UTC

IPs apparentées

Même FAI Akamai Connected Cloud — corrélation indicative.

192.46.221.91 Cross-site scripting
45.79.152.240 rtcp
172.105.208.132 Sonde PPTP
172.236.228.208 Sonde PostgreSQL
172.105.128.11 Sonde PostgreSQL

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

FTP TCP 3 RTCP TCP 2 TERADATA TCP 2

FTP

3

RTCP

2

TERADATA

2

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

7 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
21/07/2026 17:32:44 UTC	TCP	1025 · TERADATA	teradata	teradata probe teradata probe · via TERADATA:1025 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur TERADATA WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_teradata_probe teradata_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1025 Chemin / cible — Service TERADATA Payload GET / HTTP/1.1 Host: 62.3.50.33:1025 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Pourquoi cette classification : Type « teradata_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1025 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:1025 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000000c0000000000000000", "emulator_response_len": 12, "bytes_in": 202, "payload_entropy": 5.372586238135878, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "teradata", "app_proto": "teradata", "asn": 63949, "country": "US", "dst_port": 1025, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 25, "risk_boost": 20, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25 }, "risk_score": 34, "tag_count": 5, "anomaly_count": 0, "campaign_key": "93e731b16bb6a862a1011d1b1df80ec6e779c3d6", "event_fingerprint": "a85579a7a3e45f06afb902a019cc7327fde3a2f5", "classification_reason": "Type \u00ab teradata_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 34 }, "named_classification_skipped": false, "service_name": "teradata", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a673d2031ea9343fe61bbf7366463838", "path_pattern_hash": "36082129deb648fb4229f9345cdd0a13" }, "target_context": { "dst_port": 1025, "service": "teradata", "service_name": "teradata", "risk_score": 34 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1025\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1025\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1025\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1025\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1025\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab teradata_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d1f9fcd2f1f999b1a554083d38fb098c07eb9aa4", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1025\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "port": 1025, "service": "teradata", "service_label_fr": "TERADATA" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1025\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "teradata probe \u00b7 via TERADATA:1025 \u00b7 (sonde \/ probe)", "target_port_label": "1025 \u00b7 TERADATA", "emulator_service": "teradata", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab teradata_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab teradata_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 25, "risk_score": 34 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "teradata", "service_label_fr": "TERADATA", "dst_port": 1025, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-teradata", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1025\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "port": 1025, "service": "teradata", "service_label_fr": "TERADATA" }, "attack_vector": "teradata probe \u00b7 via TERADATA:1025 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:1025\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "1025 \u00b7 TERADATA", "emulator_service": "teradata", "confidence_reason": "Confiance 0 % \u2014 5 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "teradata", "service_banner": "honeypot-teradata", "service_os": "linux", "dst_port": "1025" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_teradata_probe", "teradata_emulated", "teradata_payload" ], "asn_dc_heuristic": true }
21/07/2026 17:17:12 UTC	TCP	1025 · TERADATA	teradata	Sonde PostgreSQL postgres probe · via TERADATA:1025 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 a0700378bd6d58aa Émulateur TERADATA WAF — Recommandation Surveiller Tags net_teradata_probe teradata_emulated teradata_payload tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1025 Chemin / cible — Service TERADATA Payload ��-�� WfWT߫�$� �� RKsx�� >�^��]� Z9�\|��7��_#+FW$�e jj�+�/�,�0̨̩��/5 Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��-��WfWT߫�$� �� RKsx�� >�^��]� Z9�\|��7��_#+FW$�e jj�+�/�,�0̨̩��/5 Requête brute (extrait) ��-�� WfWT߫�$� �� RKsx�� >�^��]� Z9�\|��7��_#+FW$�e jj�+�/�,�0̨̩��/5 # �+ 3&$ L��A�2�sK;{kM�4w2�G��;�U� Meta JSON brut { "protocol_emulated": true, "emulator_response": "0000000c0000000000000000", "emulator_response_len": 12, "bytes_in": 241, "payload_entropy": 5.831952391451511, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "teradata", "app_proto": "teradata", "asn": 63949, "country": "US", "dst_port": 1025, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 4, "anomaly_count": 0, "campaign_key": "a2268b95cbd4326ddee5f296a2032327c3583daa", "event_fingerprint": "a85579a7a3e45f06afb902a019cc7327fde3a2f5", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "teradata", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c22f778d434f42611cb83dc85da13498", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "ja3": "a0700378bd6d58aa3d948e7a0722042b", "ja4": "0b693e37f8b0804d1b83cc587978e645", "tls_version": "0x0303", "tls_cipher_count": 16, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "a0700378bd6d58aa3d948e7a0722042b", "tls_ja3": "771,27242-4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-11-35-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "0b693e37f8b0804d1b83cc587978e645", "tls_ja4": "t13d0116_18f59fb8566e_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 16, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 1025, "service": "teradata", "service_name": "teradata", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd-\ufffd\ufffd\u000e\fWfWT\u0012\u07eb\ufffd$\ufffd\n\ufffd\u001f\ufffd\ufffd\u000f\nRKs\u0017x\ufffd\ufffd >\ufffd\u001a^\ufffd\ufffd]\ufffd Z9\ufffd\|\ufffd\ufffd\ufffd7\u001d\ufffd\ufffd\ufffd_#\u0015+F\u0010\u0010W$\ufffde\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd-\ufffd\ufffd\u000e\fWfWT\u0012\u07eb\ufffd$\ufffd\n\ufffd\u001f\ufffd\ufffd\u000f\nRKs\u0017x\ufffd\ufffd >\ufffd\u001a^\ufffd\ufffd]\ufffd Z9\ufffd\|\ufffd\ufffd\ufffd7\u001d\ufffd\ufffd\ufffd_#\u0015+F\u0010\u0010W$\ufffde\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 L\ufffd\ufffd\ufffdA\ufffd\u00002\ufffd\u0019sK;{kM\ufffd4w2\u0000\ufffdG\ufffd\ufffd\ufffd\u0003;\ufffdU\ufffd\u000e", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd-\ufffd\ufffd\u000e\fWfWT\u0012\u07eb\ufffd$\ufffd\n\ufffd\u001f\ufffd\ufffd\u000f\nRKs\u0017x\ufffd\ufffd >\ufffd\u001a^\ufffd\ufffd]\ufffd Z9\ufffd\|\ufffd\ufffd\ufffd7\u001d\ufffd\ufffd\ufffd_#\u0015+F\u0010\u0010W$\ufffde\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2e2e0446e79471b0f23d9b6eb9c175c70808e2f0", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd-\ufffd\ufffd\u000e\fWfWT\u0012\u07eb\ufffd$\ufffd\n\ufffd\u001f\ufffd\ufffd\u000f\nRKs\u0017x\ufffd\ufffd >\ufffd\u001a^\ufffd\ufffd]\ufffd Z9\ufffd\|\ufffd\ufffd\ufffd7\u001d\ufffd\ufffd\ufffd_#\u0015+F\u0010\u0010W$\ufffde\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000", "tls_ja3": "a0700378bd6d58aa3d948e7a0722042b", "tls_ja4": "0b693e37f8b0804d1b83cc587978e645", "port": 1025, "service": "teradata", "service_label_fr": "TERADATA" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdWfWT\u07eb\ufffd$\ufffd\n\ufffd\ufffd\ufffd\nRKsx\ufffd\ufffd >\ufffd^\ufffd\ufffd]\ufffd Z9\ufffd\|\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd_#+FW$\ufffde jj\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5", "attack_vector": "postgres probe \u00b7 via TERADATA:1025 \u00b7 (sonde \/ probe)", "target_port_label": "1025 \u00b7 TERADATA", "emulator_service": "teradata", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "teradata", "service_label_fr": "TERADATA", "dst_port": 1025, "protocol_emulated": true, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-teradata", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffd-\ufffd\ufffd\u000e\fWfWT\u0012\u07eb\ufffd$\ufffd\n\ufffd\u001f\ufffd\ufffd\u000f\nRKs\u0017x\ufffd\ufffd >\ufffd\u001a^\ufffd\ufffd]\ufffd Z9\ufffd\|\ufffd\ufffd\ufffd7\u001d\ufffd\ufffd\ufffd_#\u0015+F\u0010\u0010W$\ufffde\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000", "tls_ja3": "a0700378bd6d58aa3d948e7a0722042b", "tls_ja4": "0b693e37f8b0804d1b83cc587978e645", "port": 1025, "service": "teradata", "service_label_fr": "TERADATA" }, "attack_vector": "postgres probe \u00b7 via TERADATA:1025 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd-\ufffd\ufffdWfWT\u07eb\ufffd$\ufffd\n\ufffd\ufffd\ufffd\nRKsx\ufffd\ufffd >\ufffd^\ufffd\ufffd]\ufffd Z9\ufffd\|\ufffd\ufffd\ufffd7\ufffd\ufffd\ufffd_#+FW$\ufffde jj\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5", "target_port_label": "1025 \u00b7 TERADATA", "emulator_service": "teradata", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "meta_truncated": true, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "teradata", "service_banner": "honeypot-teradata", "service_os": "linux", "dst_port": "1025" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "net_teradata_probe", "teradata_emulated", "teradata_payload", "tls_clienthello" ], "asn_dc_heuristic": true }
21/07/2026 14:10:17 UTC	TCP	21 · FTP	ftp	Sonde port 21/TCP port 21 tcp · via FTP:21 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Sonde protocole FTP Émulateur FTP WAF — Recommandation Surveiller Tags ftp_emulated http_get_probe mozi_pattern net_ftp_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 21 Chemin / cible — Preuve honeypot — Sonde port 21/TCP Connexion détectée sur le port 21 (TCP) du capteur simulé. Service FTP Payload GET / HTTP/1.1 Host: 62.3.50.33:21 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko Pourquoi cette classification : Type « port_21_tcp » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Moyen · 45 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:21 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:21 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f7420465450205365727665722072656164792e0d0a35303020556e6b6e6f776e20636f6d6d616e642e0d0a", "emulator_response_len": 54, "bytes_in": 200, "payload_entropy": 5.375165472812828, "port_category": "well_known", "org": "Akamai Connected Cloud", "service": "ftp", "app_proto": "ftp", "asn": 63949, "country": "US", "dst_port": 21, "risk_waf": 8, "risk_classification": 42, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 46, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 4.8, "risk_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 40, "protocol": 46, "novelty": 15 }, "risk_score": 45, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d4d158c232176f218a152bb3764ca592d3e1ef3d", "event_fingerprint": "07fdc90e0dd65f1bc1a6bace3f4b4df61a0c8659", "classification_reason": "Type \u00ab port_21_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 40, "protocol": 46, "novelty": 15, "risk_score": 45 }, "named_classification_skipped": true, "named_candidate": "ftp_probe", "service_name": "ftp", "risk_confidence_factor": 55, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "70951bb5e807d3b1eaa1b96537ac0e99", "path_pattern_hash": "859ddb95f048d27beffd6a8201284af6" }, "target_context": { "dst_port": 21, "service": "ftp", "service_name": "ftp", "risk_score": 45 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:21\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:21\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:21\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:21\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:21\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko", "classification_reason": "Type \u00ab port_21_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "74c9de7ed207f097b54c3f7effddab7e7b70ce04", "protocol_details": { "ftp_auth_fr": "Sonde protocole FTP", "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:21\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko", "port": 21, "service": "ftp", "service_label_fr": "FTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:21\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko", "attack_vector": "port 21 tcp \u00b7 via FTP:21 \u00b7 (sonde \/ probe)", "target_port_label": "21 \u00b7 FTP", "emulator_service": "ftp", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_21_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab port_21_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 42, "behavior": 0, "geo": 40, "protocol": 46, "novelty": 15, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "ftp", "service_label_fr": "FTP", "dst_port": 21, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-ftp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ftp_auth_fr": "Sonde protocole FTP", "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:21\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko", "port": 21, "service": "ftp", "service_label_fr": "FTP" }, "attack_vector": "port 21 tcp \u00b7 via FTP:21 \u00b7 (sonde \/ probe)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:21\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko", "target_port_label": "21 \u00b7 FTP", "emulator_service": "ftp", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ftp", "service_banner": "honeypot-ftp", "service_os": "linux", "dst_port": "21" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "ftp_emulated", "http_get_probe", "mozi_pattern", "net_ftp_probe" ], "asn_dc_heuristic": true }
21/07/2026 13:54:37 UTC	TCP	21 · FTP	ftp	Sonde PostgreSQL postgres probe · via FTP:21 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 6f2c6949a7d27ef3 Sonde protocole FTP Émulateur FTP WAF — Recommandation Surveiller Tags ftp_emulated net_ftp_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 21 Chemin / cible — Service FTP Payload ��e�D��m�2\ X�O�1^ppCwxd�� ,�Mp[a�tޢ7!��!q˿g �7�1U�U�� +�/�,�0̨̩��/5 Pourquoi cette classification :* Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��e�D��m�2\ X�O�1^ppCwxd�� ,�Mp[a�tޢ7!��!q˿g �7�1U�U�� +�/�,�0̨̩��/5 Requête brute (extrait) ��e�D��m�2\ X�O�1^ppCwxd�� ,�Mp[a�tޢ7!��!q˿g �7�1U�U�� +�/�,�0̨̩��/5 # �+ 3&$ Y5�J��pRV41��s��D�ܭ21�R1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f7420465450205365727665722072656164792e0d0a35303020556e6b6e6f776e20636f6d6d616e642e0d0a", "emulator_response_len": 54, "bytes_in": 241, "payload_entropy": 5.851046656533847, "port_category": "well_known", "org": "Akamai Connected Cloud", "service": "ftp", "app_proto": "ftp", "asn": 63949, "country": "US", "dst_port": 21, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 36, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "fb8ed69fdb663409bd4a67a27cd7334b94d5f8f3", "event_fingerprint": "07fdc90e0dd65f1bc1a6bace3f4b4df61a0c8659", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "ftp", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cc18cdb68c7c99c0793b00f4030b8262", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "ja3": "6f2c6949a7d27ef32b4415056f6b035d", "ja4": "0b693e37f8b0804d1b83cc587978e645", "tls_version": "0x0303", "tls_cipher_count": 16, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "6f2c6949a7d27ef32b4415056f6b035d", "tls_ja3": "771,6682-4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-11-35-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "0b693e37f8b0804d1b83cc587978e645", "tls_ja4": "t13d0116_18f59fb8566e_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 16, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 21, "service": "ftp", "service_name": "ftp", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffde\ufffdD\ufffd\u0014\ufffdm\ufffd\uf5cc2\\\tX\ufffdO\ufffd1^ppCwxd\ufffd\ufffd\ufffd \ufffd,\ufffdMp[a\ufffdt\u07a27!\ufffd\ufffd\u000e!q\u02ffg\r\ufffd7\ufffd1U\ufffdU\ufffd\ufffd\u0000 \u001a\u001a\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffde\ufffdD\ufffd\u0014\ufffdm\ufffd\uf5cc2\\\tX\ufffdO\ufffd1^ppCwxd\ufffd\ufffd\ufffd \ufffd,\ufffdMp[a\ufffdt\u07a27!\ufffd\ufffd\u000e!q\u02ffg\r\ufffd7\ufffd1U\ufffdU\ufffd\ufffd\u0000 \u001a\u001a\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 Y\u001b5\ufffdJ\ufffd\u0006\ufffd\u0017pRV41\ufffd\ufffds\ufffd\ufffd\ufffdD\ufffd\u072d21\ufffd\u0013R1\u0018", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffde\ufffdD\ufffd\u0014\ufffdm\ufffd\uf5cc2\\\tX\ufffdO\ufffd1^ppCwxd\ufffd\ufffd\ufffd \ufffd,\ufffdMp[a\ufffdt\u07a27!\ufffd\ufffd\u000e!q\u02ffg\r\ufffd7\ufffd1U\ufffdU\ufffd\ufffd\u0000 \u001a\u001a\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "130a986d38c99334f44c3824184317d604a9416c", "protocol_details": { "ftp_auth_fr": "Sonde protocole FTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffde\ufffdD\ufffd\u0014\ufffdm\ufffd\uf5cc2\\\tX\ufffdO\ufffd1^ppCwxd\ufffd\ufffd\ufffd \ufffd,\ufffdMp[a\ufffdt\u07a27!\ufffd\ufffd\u000e!q\u02ffg\r\ufffd7\ufffd1U\ufffdU\ufffd\ufffd\u0000 \u001a\u001a\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000", "tls_ja3": "6f2c6949a7d27ef32b4415056f6b035d", "tls_ja4": "0b693e37f8b0804d1b83cc587978e645", "port": 21, "service": "ftp", "service_label_fr": "FTP" }, "evidence_snippet": "\ufffd\ufffd\ufffde\ufffdD\ufffd\ufffdm\ufffd\uf5cc2\\\tX\ufffdO\ufffd1^ppCwxd\ufffd\ufffd\ufffd \ufffd,\ufffdMp[a\ufffdt\u07a27!\ufffd\ufffd!q\u02ffg\r\ufffd7\ufffd1U\ufffdU\ufffd\ufffd \ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5", "attack_vector": "postgres probe \u00b7 via FTP:21 \u00b7 (sonde \/ probe)", "target_port_label": "21 \u00b7 FTP", "emulator_service": "ftp", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "ftp", "service_label_fr": "FTP", "dst_port": 21, "protocol_emulated": true, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-ftp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "ftp_auth_fr": "Sonde protocole FTP", "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffde\ufffdD\ufffd\u0014\ufffdm\ufffd\uf5cc2\\\tX\ufffdO\ufffd1^ppCwxd\ufffd\ufffd\ufffd \ufffd,\ufffdMp[a\ufffdt\u07a27!\ufffd\ufffd\u000e!q\u02ffg\r\ufffd7\ufffd1U\ufffdU\ufffd\ufffd\u0000 \u001a\u001a\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000", "tls_ja3": "6f2c6949a7d27ef32b4415056f6b035d", "tls_ja4": "0b693e37f8b0804d1b83cc587978e645", "port": 21, "service": "ftp", "service_label_fr": "FTP" }, "attack_vector": "postgres probe \u00b7 via FTP:21 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffde\ufffdD\ufffd\ufffdm\ufffd\uf5cc2\\\tX\ufffd*O\ufffd1^ppCwxd\ufffd\ufffd\ufffd \ufffd,\ufffdMp[a\ufffdt\u07a27!\ufffd\ufffd!q\u02ffg\r\ufffd7\ufffd1U\ufffdU\ufffd\ufffd \ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5", "target_port_label": "21 \u00b7 FTP", "emulator_service": "ftp", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ftp", "service_banner": "honeypot-ftp", "service_os": "linux", "dst_port": "21" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "ftp_emulated", "net_ftp_probe", "tls_clienthello" ], "asn_dc_heuristic": true }
21/07/2026 13:38:28 UTC	TCP	21 · FTP	ftp	Sonde port 21/TCP port 21 tcp · via FTP:21 · (sonde / probe)	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Sonde protocole FTP Émulateur FTP WAF — Recommandation Surveiller Tags ftp_emulated net_ftp_probe redis_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 21 Chemin / cible — Preuve honeypot — Sonde port 21/TCP Connexion détectée sur le port 21 (TCP) du capteur simulé. Service FTP Payload AUTH TLS Pourquoi cette classification : Type « port_21_tcp » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Moyen · 40 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) AUTH TLS Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f7420465450205365727665722072656164792e0d0a35303020556e6b6e6f776e20636f6d6d616e642e0d0a", "emulator_response_len": 54, "bytes_in": 10, "payload_entropy": 3.121928094887362, "port_category": "well_known", "org": "Akamai Connected Cloud", "service": "ftp", "app_proto": "ftp", "asn": 63949, "country": "US", "dst_port": 21, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 36, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "f6bf07a08e98c44a8d20ab076004ded4ca418078", "event_fingerprint": "07fdc90e0dd65f1bc1a6bace3f4b4df61a0c8659", "classification_reason": "Type \u00ab port_21_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0, "risk_score": 40 }, "named_classification_skipped": true, "named_candidate": "ftp_probe", "service_name": "ftp", "risk_confidence_factor": 55, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "85b1b51e7f4eea5ab9afb2b99142a147", "path_pattern_hash": "859ddb95f048d27beffd6a8201284af6" }, "target_context": { "dst_port": 21, "service": "ftp", "service_name": "ftp", "risk_score": 40 }, "payload_preview": "AUTH TLS\r\n", "request_sample": "AUTH TLS\r\n", "payload_snippet": "AUTH TLS", "evidence": { "request_sample": "AUTH TLS\r\n", "payload_snippet": "AUTH TLS", "classification_reason": "Type \u00ab port_21_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "933816b054a8036663563a2da53833d68b5c9e78", "protocol_details": { "ftp_auth_fr": "Sonde protocole FTP", "payload_preview": "AUTH TLS", "port": 21, "service": "ftp", "service_label_fr": "FTP" }, "evidence_snippet": "AUTH TLS", "attack_vector": "port 21 tcp \u00b7 via FTP:21 \u00b7 (sonde \/ probe)", "target_port_label": "21 \u00b7 FTP", "emulator_service": "ftp", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_21_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "classification_reason_label_fr": "Type \u00ab port_21_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 36, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "ftp", "service_label_fr": "FTP", "dst_port": 21, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-ftp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "ftp_auth_fr": "Sonde protocole FTP", "payload_preview": "AUTH TLS", "port": 21, "service": "ftp", "service_label_fr": "FTP" }, "attack_vector": "port 21 tcp \u00b7 via FTP:21 \u00b7 (sonde \/ probe)", "evidence_snippet": "AUTH TLS", "target_port_label": "21 \u00b7 FTP", "emulator_service": "ftp", "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "ftp", "service_banner": "honeypot-ftp", "service_os": "linux", "dst_port": "21" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "ftp_emulated", "net_ftp_probe", "redis_probe" ], "asn_dc_heuristic": true }
21/07/2026 08:54:39 UTC	TCP	5005 · RTCP	rtcp	Sonde PostgreSQL postgres probe · via RTCP:5005 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 3f80116cf73b4082 Émulateur RTCP WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5005 Chemin / cible — Service RTCP Payload ��/z5?�Z�ϤSia�;�$[��%�r��n�A� �g��<ݒ�^L�i�u��c�8�~K�� +�/�,�0̨̩��/5 Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��/z5?�Z�ϤSia�;�$[��%�r��n�A� �g��<ݒ�^L�i�u��c�8�~K�� +�/�,�0̨̩��/5 Requête brute (extrait) ��/z5?�Z�ϤSia�;�$[��%�r��n�A� �g��<ݒ�^L�i�u��c�8�~K�� +�/�,�0̨̩��/5 # �+ 3&$ ]5%~t��`��g��/��(1��'{z5u�r Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74207274637020726561647920706f72743d353030350d0a", "emulator_response_len": 35, "bytes_in": 241, "payload_entropy": 5.795848558212441, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "rtcp", "app_proto": "rtcp", "asn": 63949, "country": "US", "dst_port": 5005, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "113d59398490dcab045104e0dc3f331b7dd31205", "event_fingerprint": "606c6359759c484b0a1a45484ef7da5fe50e5232", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "rtcp", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c230b40673e4878da60a3a21e1aa4784", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "ja3": "3f80116cf73b4082e6841b3767e8cd92", "ja4": "0b693e37f8b0804d1b83cc587978e645", "tls_version": "0x0303", "tls_cipher_count": 16, "ja3_client_category": "nmap_scanner" }, "tls_ja3_hash": "3f80116cf73b4082e6841b3767e8cd92", "tls_ja3": "771,51914-4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-11-35-13-65281-18-43-51,29-23-24-25,0", "tls_ja4_hash": "0b693e37f8b0804d1b83cc587978e645", "tls_ja4": "t13d0116_18f59fb8566e_cc710080a5f9", "tls_version": "0x0303", "tls_cipher_count": 16, "ja3_client_category": "nmap_scanner", "target_context": { "dst_port": 5005, "service": "rtcp", "service_name": "rtcp", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\/z5?\ufffdZ\ufffd\u03e4Sia\ufffd;\ufffd$[\ufffd\ufffd%\ufffdr\ufffd\ufffdn\u0015\ufffdA\u0018\ufffd \ufffdg\b\ufffd\ufffd\u0005\ufffd\ufffd<\u0752\u0000\ufffd^L\ufffdi\ufffdu\ufffd\ufffdc\ufffd8\ufffd~K\u0001\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\/z5?\ufffdZ\ufffd\u03e4Sia\ufffd;\ufffd$[\ufffd\ufffd%\ufffdr\ufffd\ufffdn\u0015\ufffdA\u0018\ufffd \ufffdg\b\ufffd\ufffd\u0005\ufffd\ufffd<\u0752\u0000\ufffd^L\ufffdi\ufffdu\ufffd\ufffdc\ufffd8\ufffd~K\u0001\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 ]5%~t\ufffd\ufffd\ufffd`\ufffd\ufffdg\ufffd\ufffd\u0017\/\ufffd\ufffd(1\ufffd\ufffd'{z5u\ufffdr\u0013", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\/z5?\ufffdZ\ufffd\u03e4Sia\ufffd;\ufffd$[\ufffd\ufffd%\ufffdr\ufffd\ufffdn\u0015\ufffdA\u0018\ufffd \ufffdg\b\ufffd\ufffd\u0005\ufffd\ufffd<\u0752\u0000\ufffd^L\ufffdi\ufffdu\ufffd\ufffdc\ufffd8\ufffd~K\u0001\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b4d3d1fdb77a5fb6aea3e8cc7e78d2d14a554635", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\/z5?\ufffdZ\ufffd\u03e4Sia\ufffd;\ufffd$[\ufffd\ufffd%\ufffdr\ufffd\ufffdn\u0015\ufffdA\u0018\ufffd \ufffdg\b\ufffd\ufffd\u0005\ufffd\ufffd<\u0752\u0000\ufffd^L\ufffdi\ufffdu\ufffd\ufffdc\ufffd8\ufffd~K\u0001\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000", "tls_ja3": "3f80116cf73b4082e6841b3767e8cd92", "tls_ja4": "0b693e37f8b0804d1b83cc587978e645", "port": 5005, "service": "rtcp", "service_label_fr": "RTCP" }, "evidence_snippet": "\ufffd\ufffd\ufffd\/z5?\ufffdZ\ufffd\u03e4Sia\ufffd;\ufffd$[\ufffd\ufffd%\ufffdr\ufffd\ufffdn\ufffdA\ufffd \ufffdg\ufffd\ufffd\ufffd\ufffd<\u0752\ufffd^L\ufffdi\ufffdu\ufffd\ufffdc\ufffd8\ufffd~K\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5", "attack_vector": "postgres probe \u00b7 via RTCP:5005 \u00b7 (sonde \/ probe)", "target_port_label": "5005 \u00b7 RTCP", "emulator_service": "rtcp", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "rtcp", "service_label_fr": "RTCP", "dst_port": 5005, "protocol_emulated": true, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtcp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\/z5?\ufffdZ\ufffd\u03e4Sia\ufffd;\ufffd$[\ufffd\ufffd%\ufffdr\ufffd\ufffdn\u0015\ufffdA\u0018\ufffd \ufffdg\b\ufffd\ufffd\u0005\ufffd\ufffd<\u0752\u0000\ufffd^L\ufffdi\ufffdu\ufffd\ufffdc\ufffd8\ufffd~K\u0001\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000", "tls_ja3": "3f80116cf73b4082e6841b3767e8cd92", "tls_ja4": "0b693e37f8b0804d1b83cc587978e645", "port": 5005, "service": "rtcp", "service_label_fr": "RTCP" }, "attack_vector": "postgres probe \u00b7 via RTCP:5005 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\/z5?\ufffdZ\ufffd\u03e4Sia\ufffd;\ufffd$[\ufffd\ufffd%\ufffdr\ufffd\ufffdn\ufffdA\ufffd \ufffdg\ufffd\ufffd\ufffd\ufffd<\u0752\ufffd^L\ufffdi\ufffdu\ufffd\ufffdc\ufffd8\ufffd~K\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5", "target_port_label": "5005 \u00b7 RTCP", "emulator_service": "rtcp", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtcp", "service_banner": "honeypot-rtcp", "service_os": "linux", "dst_port": "5005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ], "asn_dc_heuristic": true }
21/07/2026 08:39:03 UTC	TCP	5005 · RTCP	rtcp	Botnet Mozi mozi pattern · via RTCP:5005 · (commande & contrôle)	Élevée	Moyen · 42
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0011 TA0011 Protocole Émulateur RTCP WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5005 Chemin / cible — Service RTCP Payload GET / HTTP/1.1 Host: 62.3.50.33:5005 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Pourquoi cette classification : Type « mozi_pattern » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Moyen · 42 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE TA0011 User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5005 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5005 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "32323020686f6e6579706f74207274637020726561647920706f72743d353030350d0a", "emulator_response_len": 35, "bytes_in": 202, "payload_entropy": 5.3586267377970955, "port_category": "registered", "org": "Akamai Connected Cloud", "service": "rtcp", "app_proto": "rtcp", "asn": 63949, "country": "US", "dst_port": 5005, "risk_waf": 8, "risk_classification": 82, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15 }, "risk_score": 42, "tag_count": 3, "anomaly_count": 0, "campaign_key": "29ac18ed5210506b18ee00882114a7bde3202b61", "event_fingerprint": "2eff11117aba3b41665d6c6eb4a00aa259989d28", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15, "risk_score": 42 }, "named_classification_skipped": false, "service_name": "rtcp", "risk_confidence_factor": 0, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 63949, "org": "Akamai Connected Cloud", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "648f62d39afd28871116c651a2b62264", "path_pattern_hash": "762d384fab941f6d0c2239f19994f30e" }, "target_context": { "dst_port": 5005, "service": "rtcp", "service_name": "rtcp", "risk_score": 42 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5005\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5005\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5005\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5005\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/133.0.0.0 Safari\/537.36\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5005\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%" }, "attack_stage": "c2", "mitre_tactics": [ "TA0011" ], "mitre": "TA0011", "threat_family": [ "botnet" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "419367769bb7f0c3c4c8c05bbe921b2aad677b87", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5005\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "port": 5005, "service": "rtcp", "service_label_fr": "RTCP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5005\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "attack_vector": "mozi pattern \u00b7 via RTCP:5005 \u00b7 (commande & contr\u00f4le)", "target_port_label": "5005 \u00b7 RTCP", "emulator_service": "rtcp", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE TA0011 \u2014 via RTCP", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 82, "behavior": 0, "geo": 40, "protocol": 40, "novelty": 15, "risk_score": 42 }, "attack_stage": "c2", "attack_stage_label": "Commande & contr\u00f4le", "attack_chain_stage": "command_and_control", "attack_chain_stage_label_fr": "Commande & contr\u00f4le", "risk_score": 42, "risk_label": "Moyen", "service_name": "rtcp", "service_label_fr": "RTCP", "dst_port": 5005, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0011", "mitre_technique": "TA0011", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-rtcp", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5005\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "port": 5005, "service": "rtcp", "service_label_fr": "RTCP" }, "attack_vector": "mozi pattern \u00b7 via RTCP:5005 \u00b7 (commande & contr\u00f4le)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5005\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gec", "target_port_label": "5005 \u00b7 RTCP", "emulator_service": "rtcp", "confidence_reason": "Confiance 0 % \u2014 3 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "stage" }, { "key": "command_and_control", "label_fr": "Commande & contr\u00f4le", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "rtcp", "service_banner": "honeypot-rtcp", "service_os": "linux", "dst_port": "5005" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "command_and_control", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ], "asn_dc_heuristic": true }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

45.79.192.232

Profil de menace

Pourquoi listée

Comparaison ASN / FAI

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence