Fiche IP

Suisse

46.19.137.154

Activité suspecte — risque 43/100 (Moyen) — MITRE TA0001 — confiance 70 % — via HTTP — multi-protocole (2 protocoles · 5 min)

FAI Private Layer INC Première vue 30/10/2026 09:32 UTC Dernière vue 03/11/2026 22:52 UTC Risque Moyen

Période 2026-11-03 → 2026-11-04

Moyen 59/100

24h 7j 30j 90j

Synthèse

Score de risque max. 59/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 30/10/2026 09:32 UTC

Dernière observation 03/11/2026 22:52 UTC

Événements (période) 21

Décision conseillée Surveiller Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal TA0007 13 occurrences

Pourquoi listée

Tentative d'exploit (tag rce-0) · confiance 62%

Confiance 70 % — Score WAF 60 · Bonus corrélation +8 · 2 tag(s) WAF

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

59/100 Confiance 70 % 21 événements TA0007

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 46.19.137.154
Décision : Investiguer
Score max : 59/100 (Moyen)
Confiance : 70 %
Période : 2026-11-03 → 2026-11-04 · 21 événements
Motif : Tentative d'exploit (tag rce-0) · confiance 62%
MITRE : TA0007
FAI : Private Layer INC · Suisse

Comparaison ASN / FAI

ASN 51852 · 46.19.136.0/21 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 21 événements sur la période pour cette IP.

46.19.137.157 Traversal LFI 30/10/2026 15:50 UTC
46.19.137.155 Traversal LFI 30/10/2026 15:46 UTC
46.19.137.156 SSRF interne 30/10/2026 09:37 UTC
190.211.252.18 Sonde HTTP 19/10/2026 10:52 UTC
179.43.146.27 Sonde PostgreSQL 18/10/2026 22:46 UTC
179.43.167.3 Sonde SIP 17/10/2026 13:18 UTC
179.43.158.121 Sonde PPTP 17/10/2026 05:18 UTC
179.43.153.2 Sonde SSH 16/10/2026 10:09 UTC

Événements (filtres)

Première observation

30/10/2026 09:32 UTC

Dernière observation

03/11/2026 22:52 UTC

Dernière activité (filtres)

03/11/2026 22:52 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 14 DOCKER TCP 3 FLINK TCP 2 UPNP TCP TCP 2

HTTP

DOCKER

FLINK

UPNP TCP

Géolocalisation

Origine réseau déclarée

Suisse unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Private Layer INC 0 Port 3001 Sonde API

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

exploit attempt · via HTTP:3001 · (tentative d'exploit) · → /version

Détails protocole

Méthode: GET
Chemin: /version
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 S…

Aperçu payload

GET /version HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, l

Port / service

3001 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 62 % — 2 tag(s) WAF

Technique MITRE

TA0001

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1190

Confiance

70% Corrélation +8

Famille de menace

unknown

MITRE ATT&CK — tactiques observées

Accès initial Exécution

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

21 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

21 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
03/11/2026 22:52:51 UTC	TCP	3001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:3001 · (tentative d'exploit) · → /version	Élevée	Moyen · 43
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 Accès Exécution Protocole GET /version UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 13 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 net_web_probe Cible HTTP GET /version TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3001 Chemin / cible /version Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 43 Confiance : Confiance 62 % — 2 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET /version HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /version HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, l Requête brute (extrait) GET /version HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d","emulator_response_len":107,"http_header_count":5,"http_query_params":0,"http_path_depth":1,"http_path_ext":null,"http_ua_hash":"7b6f0c373feb98078719dc155349d959f98d35fe","http_host_hash":"68964bd149320edbceb0d6a222e6bc3e0bdb74e3","http_target_hash":"76c5a6fe5f8bec907b8dcab1abdf135058b50bc3","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":243,"payload_entropy":5.351072882770805,"port_category":"registered","org":"Private Layer INC","service":"http","app_proto":"http","asn":51852,"country":"CH","dst_port":3001,"risk_waf":60,"risk_classification":72,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":15,"risk_boost":0,"risk_granularity":5,"risk_breakdown":{"waf":60,"classification":72,"behavior":0,"geo":0,"protocol":33,"novelty":15},"risk_score":43,"tag_count":3,"anomaly_count":0,"campaign_key":"46620a675490e21a3e34a8efbbfc18272aea9be0","event_fingerprint":"25f592fe082dd79ba1f36a486844a5eb203d35f3","classification_reason":"Tentative d'exploit (tag rce-0) \u00b7 confiance 62%","confidence":0.7,"classification_confidence":0.7,"precision_score":73,"precision_signals":["MITRE-T1190"],"kb_rule_ids":["MITRE-T1190"],"confidence_breakdown":{"waf":60,"classifi…
03/11/2026 22:52:50 UTC	TCP	3001 · HTTP	http	Énumération API REST rest api enum · via HTTP:3001 · (sonde / probe) · → /api/v1/models	Élevée	Moyen · 59
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole GET /api/v1/models UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 31 Recommandation Investiguer Tags 950316:lfi-14 950326:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /api/v1/models TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3001 Chemin / cible /api/v1/models Service HTTP Pourquoi cette classification : Énumération API REST (tag lfi-14) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 59 Confiance : Confiance 95 % — 5 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190-api Upstream Api Probe Generic Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET /api/v1/models HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF lfi-14 rce-0 nosqli-3 k8s-api Payload (extrait) GET /api/v1/models HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KH Requête brute (extrait) GET /api/v1/models HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d","emulator_response_len":107,"http_header_count":5,"http_query_params":0,"http_path_depth":3,"http_path_ext":null,"http_ua_hash":"7b6f0c373feb98078719dc155349d959f98d35fe","http_host_hash":"68964bd149320edbceb0d6a222e6bc3e0bdb74e3","http_target_hash":"49251bf205b1f9a34c71c4015839e00ca9e5491a","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":249,"payload_entropy":5.357893637732436,"port_category":"registered","org":"Private Layer INC","service":"http","app_proto":"http","asn":51852,"country":"CH","dst_port":3001,"risk_waf":100,"risk_classification":60,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":7,"risk_breakdown":{"waf":100,"classification":60,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":59,"tag_count":9,"anomaly_count":0,"campaign_key":"80b16807969d2baac49a38d53b9dcae736280523","event_fingerprint":"5cd7f519f536b3175165d1aa152b450031141c3d","classification_reason":"\u00c9num\u00e9ration API REST (tag lfi-14) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":107,"precision_signals":["MITRE-T1190-api","INT-upstream","INT-api-probe-generic"],"kb_rule_ids":["MI…
03/11/2026 22:52:50 UTC	TCP	3001 · HTTP	http	Sonde API probe api · via HTTP:3001 · (sonde / probe) · → /api/models	Élevée	Moyen · 55
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole GET /api/models UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 23 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950600:k8s-api Cible HTTP GET /api/models TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3001 Chemin / cible /api/models Service HTTP Pourquoi cette classification : Type « Sonde API » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 55 Confiance : Confiance 50 % — 4 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET /api/models HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 k8s-api Payload (extrait) GET /api/models HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML Requête brute (extrait) GET /api/models HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d","emulator_response_len":107,"http_header_count":5,"http_query_params":0,"http_path_depth":2,"http_path_ext":null,"http_ua_hash":"7b6f0c373feb98078719dc155349d959f98d35fe","http_host_hash":"68964bd149320edbceb0d6a222e6bc3e0bdb74e3","http_target_hash":"605f19cd9e4e064426f103c259b8babf37b5441a","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":246,"payload_entropy":5.343921290597295,"port_category":"registered","org":"Private Layer INC","service":"http","app_proto":"http","asn":51852,"country":"CH","dst_port":3001,"risk_waf":100,"risk_classification":60,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":6.1,"risk_breakdown":{"waf":100,"classification":60,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":55,"tag_count":6,"anomaly_count":0,"campaign_key":"b920f8b13735e52a4577ff0ea4257ac72935420d","event_fingerprint":"ebcb7a04e730dd196fbc6d46f5c3da774e2ce5b3","classification_reason":"Type \u00ab probe_api \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence":0.58,"classification_confidence":0.58,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream…
03/11/2026 22:52:50 UTC	TCP	3001 · HTTP	http	Sonde API probe api · via HTTP:3001 · (sonde / probe) · → /api/config	Élevée	Moyen · 55
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole GET /api/config UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 23 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 950600:k8s-api Cible HTTP GET /api/config TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3001 Chemin / cible /api/config Service HTTP Pourquoi cette classification : Type « Sonde API » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 55 Confiance : Confiance 50 % — 4 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Ligne de requête `GET /api/config HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 k8s-api Payload (extrait) GET /api/config HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML Requête brute (extrait) GET /api/config HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d","emulator_response_len":107,"http_header_count":5,"http_query_params":0,"http_path_depth":2,"http_path_ext":null,"http_ua_hash":"7b6f0c373feb98078719dc155349d959f98d35fe","http_host_hash":"68964bd149320edbceb0d6a222e6bc3e0bdb74e3","http_target_hash":"3c5fcdb0fafcc174d1f9556c1cd63005351cd3bc","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":246,"payload_entropy":5.339675844033382,"port_category":"registered","org":"Private Layer INC","service":"http","app_proto":"http","asn":51852,"country":"CH","dst_port":3001,"risk_waf":100,"risk_classification":60,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":25,"risk_boost":0,"risk_granularity":6.1,"risk_breakdown":{"waf":100,"classification":60,"behavior":0,"geo":0,"protocol":43,"novelty":25},"risk_score":55,"tag_count":6,"anomaly_count":0,"campaign_key":"b920f8b13735e52a4577ff0ea4257ac72935420d","event_fingerprint":"dfeb10667328c53cc6b67f67fd5bd640773b9724","classification_reason":"Type \u00ab probe_api \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence":0.58,"classification_confidence":0.58,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream…
03/11/2026 22:48:07 UTC	TCP	11434 · HTTP	http	Scan de ports port scan syn · via HTTP:11434 · (reconnaissance)	Élevée	Moyen · 51
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 11434 Chemin / cible / Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 51 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:11434 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:11434 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"7b6f0c373feb98078719dc155349d959f98d35fe","http_host_hash":"0edcf6ab7022a3c1a90b1ad0670bd95a56782eca","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":237,"payload_entropy":5.3552797034597255,"port_category":"registered","org":"Private Layer INC","service":"http","app_proto":"http","asn":51852,"country":"CH","dst_port":11434,"risk_waf":72,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.6,"risk_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":33,"novelty":15},"risk_score":51,"tag_count":4,"anomaly_count":0,"campaign_key":"1ceb5927b6382f021e8b1570f8f5a4d2bc956d6d","event_fingerprint":"a3553765b40ae8c1aad4a494700a0a9576b68290","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046"…
03/11/2026 22:48:01 UTC	TCP	9099 · FLINK	flink	Scan de ports port scan syn · via FLINK:9099 · (reconnaissance)	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole Émulateur FLINK WAF — Recommandation Surveiller Tags flink_emulated flink_payload http_get_probe mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9099 Chemin / cible — Service FLINK Payload GET / HTTP/1.1 Host: 62.3.50.33:9099 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 49 Confiance : Confiance 100 % — 5 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9099 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9099 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420666c696e6b20726561647920706f72743d393039390d0a","emulator_response_len":36,"bytes_in":236,"payload_entropy":5.378562141210374,"port_category":"registered","org":"Private Layer INC","service":"flink","app_proto":"flink","asn":51852,"country":"CH","dst_port":9099,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":40,"risk_novelty":25,"risk_boost":20,"risk_granularity":4.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":40,"novelty":25},"risk_score":49,"tag_count":5,"anomaly_count":0,"campaign_key":"0e647f40f68a2cd004f16598e2c944def37bcecb","event_fingerprint":"87faa6741f9d84628e3f125521a0f4b29443206e","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":40,"novelty":25,"risk_score":49,"correlation_boost":14},"named_classification_skipped":false,"service_name":"flink","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"CH","asn":51852,"org":"Private Layer INC","is_datacenter":false,"is_tor_hint":fal…
03/11/2026 22:47:55 UTC	TCP	8188 · HTTP	http	Scan de ports port scan syn · via HTTP:8188 · (reconnaissance)	Élevée	Moyen · 47
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8188 Chemin / cible / Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 47 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8188 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8188 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"7b6f0c373feb98078719dc155349d959f98d35fe","http_host_hash":"12b1e03c9f1fd6fb2f24712b7347a2b07bd85606","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":236,"payload_entropy":5.380462060768453,"port_category":"registered","org":"Private Layer INC","service":"http","app_proto":"http","asn":51852,"country":"CH","dst_port":8188,"risk_waf":72,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.7,"risk_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":47,"tag_count":3,"anomaly_count":0,"campaign_key":"becd3f7615e04cc7c7130527ff8ee38faf304fc3","event_fingerprint":"073fe82599383cb052e89d25224a856b01d1f7f8","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":47,"correlation_boost":14},"named_classification_skipped"…
03/11/2026 22:47:49 UTC	TCP	7860 · HTTP	http	Scan de ports port scan syn · via HTTP:7860 · (reconnaissance)	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7860 Chemin / cible / Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 49 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7860 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7860 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"7b6f0c373feb98078719dc155349d959f98d35fe","http_host_hash":"2c150a2d584bc4a893931e17fa43c152a5272207","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":236,"payload_entropy":5.37051072371084,"port_category":"registered","org":"Private Layer INC","service":"http","app_proto":"http","asn":51852,"country":"CH","dst_port":7860,"risk_waf":72,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.8,"risk_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":49,"tag_count":3,"anomaly_count":0,"campaign_key":"89197e2d4a8965a9b6edc2c584f09784b1ee8d4e","event_fingerprint":"91081c8997858952c7d3a90fd26c5670be898e6a","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":49,"correlation_boost":14},"named_classification_skipped":false,"service_name":"http","risk_confiden…
03/11/2026 22:47:43 UTC	TCP	5678 · HTTP	http	Scan de ports port scan syn · via HTTP:5678 · (reconnaissance)	Élevée	Moyen · 47
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5678 Chemin / cible / Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 47 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5678 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5678 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"7b6f0c373feb98078719dc155349d959f98d35fe","http_host_hash":"96eff9443c4674eb892414ac0b9a5390c40fc8e7","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":236,"payload_entropy":5.373641550283552,"port_category":"registered","org":"Private Layer INC","service":"http","app_proto":"http","asn":51852,"country":"CH","dst_port":5678,"risk_waf":72,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.8,"risk_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":47,"tag_count":3,"anomaly_count":0,"campaign_key":"1155089fca6ebe1b8b220ab45c73960d92cbc9c5","event_fingerprint":"55919a03b104b7182f6fea346c2a3ee2408a7deb","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":47,"correlation_boost":8},"named_classification_skipped":false,"service_name":"http","risk_confiden…
03/11/2026 22:47:40 UTC	TCP	5001 · UPNP TCP	upnp-tcp	Botnet Mozi mozi pattern · via UPNP TCP:5001 · (commande & contrôle)	Élevée	Faible · 36
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0011 Commande Protocole Émulateur UPNP-TCP WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Payload GET / HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Pourquoi cette classification : Type « Botnet Mozi » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 36 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE Commande & contrôle User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a","emulator_response_len":39,"bytes_in":236,"payload_entropy":5.347696833942814,"port_category":"registered","org":"Private Layer INC","service":"upnp-tcp","app_proto":"upnp-tcp","asn":51852,"country":"CH","dst_port":5001,"risk_waf":8,"risk_classification":82,"risk_behavior":0,"risk_geo":0,"risk_protocol":40,"risk_novelty":15,"risk_boost":20,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":82,"behavior":0,"geo":0,"protocol":40,"novelty":15},"risk_score":36,"tag_count":3,"anomaly_count":0,"campaign_key":"026f36b3ffe414862f6c505b08a38f2a9ee910e5","event_fingerprint":"c4fbc45603d24d7eb870e14692e418def7cee731","classification_reason":"Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":82,"behavior":0,"geo":0,"protocol":40,"novelty":15,"risk_score":36,"correlation_boost":8},"named_classification_skipped":false,"service_name":"upnp-tcp","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"CH","asn":51852,"org":"Private Layer INC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"0b5738784bd4bd85488cc4d6ce71e6d7","path_pattern_hash":"762d384fab941f6d0c2239f19994f30e"},"target_context":{"dst_p…
03/11/2026 22:47:17 UTC	TCP	3001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:3001 · (tentative d'exploit)	Élevée	Moyen · 48
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 Accès Exécution Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 48 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d","emulator_response_len":107,"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"7b6f0c373feb98078719dc155349d959f98d35fe","http_host_hash":"68964bd149320edbceb0d6a222e6bc3e0bdb74e3","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":236,"payload_entropy":5.343799865559153,"port_category":"registered","org":"Private Layer INC","service":"http","app_proto":"http","asn":51852,"country":"CH","dst_port":3001,"risk_waf":72,"risk_classification":72,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.4,"risk_breakdown":{"waf":72,"classification":72,"behavior":0,"geo":0,"protocol":33,"novelty":15},"risk_score":48,"tag_count":4,"anomaly_count":0,"campaign_key":"5b362e1ea8c2665ca13b204fa28ce5d181c86440","event_fingerprint":"e6882368d4d43861768ebe8f77756242fd588fe4","classification_reason":"Tentative d'exploit (tag rce-0) \u00b7 confiance 62%","confidence":0.7,"classification_confidence":0.7,"precision_score":73,"precision_signals":["MITRE-T1190"],"kb_rule_ids":["MITRE-T1190"],"confidence_breakdown":{"waf":72,"classi…
03/11/2026 22:45:49 UTC	TCP	11434 · HTTP	http	Scan de ports port scan syn · via HTTP:11434 · (reconnaissance)	Élevée	Moyen · 51
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Investiguer Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 11434 Chemin / cible / Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 51 Confiance : Confiance 100 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:11434 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Ge Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:11434 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"7b6f0c373feb98078719dc155349d959f98d35fe","http_host_hash":"0edcf6ab7022a3c1a90b1ad0670bd95a56782eca","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":237,"payload_entropy":5.3552797034597255,"port_category":"registered","org":"Private Layer INC","service":"http","app_proto":"http","asn":51852,"country":"CH","dst_port":11434,"risk_waf":72,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.6,"risk_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":33,"novelty":15},"risk_score":51,"tag_count":4,"anomaly_count":0,"campaign_key":"1ceb5927b6382f021e8b1570f8f5a4d2bc956d6d","event_fingerprint":"a3553765b40ae8c1aad4a494700a0a9576b68290","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046"…
03/11/2026 22:45:43 UTC	TCP	9099 · FLINK	flink	Scan de ports port scan syn · via FLINK:9099 · (reconnaissance)	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole Émulateur FLINK WAF — Recommandation Surveiller Tags flink_emulated flink_payload http_get_probe mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9099 Chemin / cible — Service FLINK Payload GET / HTTP/1.1 Host: 62.3.50.33:9099 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 49 Confiance : Confiance 100 % — 5 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9099 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:9099 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420666c696e6b20726561647920706f72743d393039390d0a","emulator_response_len":36,"bytes_in":236,"payload_entropy":5.378562141210374,"port_category":"registered","org":"Private Layer INC","service":"flink","app_proto":"flink","asn":51852,"country":"CH","dst_port":9099,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":40,"risk_novelty":25,"risk_boost":20,"risk_granularity":4.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":40,"novelty":25},"risk_score":49,"tag_count":5,"anomaly_count":0,"campaign_key":"0e647f40f68a2cd004f16598e2c944def37bcecb","event_fingerprint":"87faa6741f9d84628e3f125521a0f4b29443206e","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":40,"novelty":25,"risk_score":49,"correlation_boost":14},"named_classification_skipped":false,"service_name":"flink","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"CH","asn":51852,"org":"Private Layer INC","is_datacenter":false,"is_tor_hint":fal…
03/11/2026 22:45:35 UTC	TCP	8188 · HTTP	http	Scan de ports port scan syn · via HTTP:8188 · (reconnaissance)	Élevée	Moyen · 47
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8188 Chemin / cible / Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 47 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8188 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8188 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"7b6f0c373feb98078719dc155349d959f98d35fe","http_host_hash":"12b1e03c9f1fd6fb2f24712b7347a2b07bd85606","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":236,"payload_entropy":5.380462060768453,"port_category":"registered","org":"Private Layer INC","service":"http","app_proto":"http","asn":51852,"country":"CH","dst_port":8188,"risk_waf":72,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.7,"risk_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":47,"tag_count":3,"anomaly_count":0,"campaign_key":"becd3f7615e04cc7c7130527ff8ee38faf304fc3","event_fingerprint":"073fe82599383cb052e89d25224a856b01d1f7f8","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":47,"correlation_boost":14},"named_classification_skipped"…
03/11/2026 22:45:30 UTC	TCP	7860 · HTTP	http	Scan de ports port scan syn · via HTTP:7860 · (reconnaissance)	Élevée	Moyen · 49
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 7860 Chemin / cible / Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 49 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7860 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:7860 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"7b6f0c373feb98078719dc155349d959f98d35fe","http_host_hash":"2c150a2d584bc4a893931e17fa43c152a5272207","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":236,"payload_entropy":5.37051072371084,"port_category":"registered","org":"Private Layer INC","service":"http","app_proto":"http","asn":51852,"country":"CH","dst_port":7860,"risk_waf":72,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":3.8,"risk_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":49,"tag_count":3,"anomaly_count":0,"campaign_key":"89197e2d4a8965a9b6edc2c584f09784b1ee8d4e","event_fingerprint":"91081c8997858952c7d3a90fd26c5670be898e6a","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":49,"correlation_boost":14},"named_classification_skipped":false,"service_name":"http","risk_confiden…
03/11/2026 22:45:23 UTC	TCP	5678 · HTTP	http	Scan de ports port scan syn · via HTTP:5678 · (reconnaissance)	Élevée	Moyen · 47
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 5678 Chemin / cible / Service HTTP Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 47 Confiance : Confiance 100 % — 3 tag(s) WAF Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5678 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5678 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"7b6f0c373feb98078719dc155349d959f98d35fe","http_host_hash":"96eff9443c4674eb892414ac0b9a5390c40fc8e7","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":236,"payload_entropy":5.373641550283552,"port_category":"registered","org":"Private Layer INC","service":"http","app_proto":"http","asn":51852,"country":"CH","dst_port":5678,"risk_waf":72,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.8,"risk_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15},"risk_score":47,"tag_count":3,"anomaly_count":0,"campaign_key":"1155089fca6ebe1b8b220ab45c73960d92cbc9c5","event_fingerprint":"55919a03b104b7182f6fea346c2a3ee2408a7deb","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":72,"classification":64,"behavior":0,"geo":0,"protocol":25,"novelty":15,"risk_score":47,"correlation_boost":8},"named_classification_skipped":false,"service_name":"http","risk_confiden…
03/11/2026 22:45:20 UTC	TCP	5001 · UPNP TCP	upnp-tcp	Botnet Mozi mozi pattern · via UPNP TCP:5001 · (commande & contrôle)	Élevée	Faible · 36
Étape Commande & contrôle Chaîne Commande & contrôle Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0011 Commande Protocole Émulateur UPNP-TCP WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5001 Chemin / cible — Service UPNP TCP Payload GET / HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Pourquoi cette classification : Type « Botnet Mozi » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 36 Confiance : Confiance 0 % — 3 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0011 Tactiques MITRE Commande & contrôle User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:5001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f742075706e705f74637020726561647920706f72743d353030310d0a","emulator_response_len":39,"bytes_in":236,"payload_entropy":5.347696833942814,"port_category":"registered","org":"Private Layer INC","service":"upnp-tcp","app_proto":"upnp-tcp","asn":51852,"country":"CH","dst_port":5001,"risk_waf":8,"risk_classification":82,"risk_behavior":0,"risk_geo":0,"risk_protocol":40,"risk_novelty":15,"risk_boost":20,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":82,"behavior":0,"geo":0,"protocol":40,"novelty":15},"risk_score":36,"tag_count":3,"anomaly_count":0,"campaign_key":"026f36b3ffe414862f6c505b08a38f2a9ee910e5","event_fingerprint":"c4fbc45603d24d7eb870e14692e418def7cee731","classification_reason":"Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":82,"behavior":0,"geo":0,"protocol":40,"novelty":15,"risk_score":36,"correlation_boost":8},"named_classification_skipped":false,"service_name":"upnp-tcp","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"CH","asn":51852,"org":"Private Layer INC","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"0b5738784bd4bd85488cc4d6ce71e6d7","path_pattern_hash":"762d384fab941f6d0c2239f19994f30e"},"target_context":{"dst_p…
03/11/2026 22:44:57 UTC	TCP	3001 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:3001 · (tentative d'exploit)	Élevée	Moyen · 48
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 Accès Exécution Protocole GET / UA Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (K… Émulateur HTTP WAF 16 Recommandation Surveiller Tags 950326:rce-0 950470:nosqli-3 950734:sap-sapcontrol-path net_web_probe Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 62% Risque capteur Moyen · 48 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE Accès initial Exécution Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, zstd Accept: / Connection: close Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d","emulator_response_len":107,"http_header_count":5,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"7b6f0c373feb98078719dc155349d959f98d35fe","http_host_hash":"68964bd149320edbceb0d6a222e6bc3e0bdb74e3","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":236,"payload_entropy":5.343799865559153,"port_category":"registered","org":"Private Layer INC","service":"http","app_proto":"http","asn":51852,"country":"CH","dst_port":3001,"risk_waf":72,"risk_classification":72,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.4,"risk_breakdown":{"waf":72,"classification":72,"behavior":0,"geo":0,"protocol":33,"novelty":15},"risk_score":48,"tag_count":4,"anomaly_count":0,"campaign_key":"5b362e1ea8c2665ca13b204fa28ce5d181c86440","event_fingerprint":"e6882368d4d43861768ebe8f77756242fd588fe4","classification_reason":"Tentative d'exploit (tag rce-0) \u00b7 confiance 62%","confidence":0.62,"classification_confidence":0.62,"precision_score":73,"precision_signals":["MITRE-T1190"],"kb_rule_ids":["MITRE-T1190"],"confidence_breakdown":{"waf":72,"clas…
03/11/2026 21:23:48 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 23
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /containers/json?all=1 HTTP/1.1 Host: 62.3.50.33:2375 Accept: / Pourquoi cette classification : Type « Sonde API Docker » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 23 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) GET /containers/json?all=1 HTTP/1.1 Host: 62.3.50.33:2375 Accept: / Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234","emulator_response_len":162,"bytes_in":75,"payload_entropy":4.894964023598446,"port_category":"registered","org":"Private Layer INC","service":"docker","app_proto":"docker","asn":51852,"country":"CH","dst_port":2375,"risk_waf":8,"risk_classification":60,"risk_behavior":0,"risk_geo":0,"risk_protocol":40,"risk_novelty":25,"risk_boost":0,"risk_granularity":4.8,"risk_breakdown":{"waf":8,"classification":60,"behavior":0,"geo":0,"protocol":40,"novelty":25},"risk_score":23,"tag_count":5,"anomaly_count":0,"campaign_key":"8c1839cdbd9fa9388eb8b04668a8b57ccf5e28c3","event_fingerprint":"00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e","classification_reason":"Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":60,"behavior":0,"geo":0,"protocol":40,"novelty":25,"risk_score":23},"named_classification_skipped":false,"service_name":"docker","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"CH","asn":51852,"org":"Private Layer INC","is_datacenter":false,"is_tor_hint":false…
03/11/2026 21:23:10 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 23
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_api_probe docker_emulated docker_payload http_get_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Payload GET /version HTTP/1.1 Host: 62.3.50.33:2375 Accept: / Pourquoi cette classification : Type « Sonde API Docker » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 23 Confiance : Confiance 0 % — 5 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) GET /version HTTP/1.1 Host: 62.3.50.33:2375 Accept: / Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234","emulator_response_len":162,"bytes_in":61,"payload_entropy":4.713283853849926,"port_category":"registered","org":"Private Layer INC","service":"docker","app_proto":"docker","asn":51852,"country":"CH","dst_port":2375,"risk_waf":8,"risk_classification":60,"risk_behavior":0,"risk_geo":0,"risk_protocol":40,"risk_novelty":25,"risk_boost":0,"risk_granularity":4.8,"risk_breakdown":{"waf":8,"classification":60,"behavior":0,"geo":0,"protocol":40,"novelty":25},"risk_score":23,"tag_count":5,"anomaly_count":0,"campaign_key":"8c1839cdbd9fa9388eb8b04668a8b57ccf5e28c3","event_fingerprint":"00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e","classification_reason":"Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":60,"behavior":0,"geo":0,"protocol":40,"novelty":25,"risk_score":23},"named_classification_skipped":false,"service_name":"docker","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"CH","asn":51852,"org":"Private Layer INC","is_datacenter":false,"is_tor_hint":false…
03/11/2026 21:22:10 UTC	TCP	2375 · DOCKER	docker	Sonde API Docker docker api probe · via DOCKER:2375 · (sonde / probe)	Élevée	Faible · 23
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur DOCKER WAF — Recommandation Surveiller Tags docker_emulated net_docker_api_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2375 Chemin / cible — Service DOCKER Pourquoi cette classification : Type « Sonde API Docker » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 23 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a5365727665723a20446f636b65722f32342e302e350d0a436f6e74656e742d4c656e6774683a2036380d0a0d0a7b2241706956657273696f6e223a22312e3431222c2256657273696f6e223a223234","emulator_response_len":162,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Private Layer INC","service":"docker","app_proto":"docker","asn":51852,"country":"CH","dst_port":2375,"risk_waf":8,"risk_classification":60,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.7,"risk_breakdown":{"waf":8,"classification":60,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":23,"tag_count":2,"anomaly_count":0,"campaign_key":"7fac8b9fb4e847c8c2abe3f25f6668d2413acad8","event_fingerprint":"00a875d783a0dbdbe0de1f97f4b47b47ab6b3d3e","classification_reason":"Type \u00ab docker_api_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0,"classification_confidence":0,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":60,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":23},"named_classification_skipped":false,"service_name":"docker","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"CH","asn":51852,"org":"Private Layer INC","is_datacenter":false,"is_tor_hi…

46.19.137.154

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence