{"ip":"47.239.31.0","exported_at":"2026-07-18T21:15:00+00:00","period_days":1,"metrics":{"events7d":24,"distinct_ports":7,"distinct_classifications":8,"max_severity":10,"last_sensor_id":"paris-1","max_waf_score":24,"max_risk_score":59,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["unknown"],"recommended_action":"monitor","confidence":0.57,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":22,"novelty":0},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":10,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 35\/100","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":22,"novelty":0,"risk_score":35,"correlation_boost":8},"persona_hostname":"mail.sensor-1.internal","correlation_flags":["multi_protocol_correlation"],"correlation_flags_labels_fr":["Multi-protocole corr\u00e9l\u00e9 (5 min)"],"confidence_pct":57,"confidence_hint_fr":"Corr\u00e9lation +8","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0348"],"tags_summary":["pat-0348"],"attack_vector":"port 135 tcp \u00b7 via MSRPC:135 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\u0005\u0000\u000b\u0003\u0010\u0000\u0000\u0000H\u0000\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u000f\ufffd\u000f\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u0000+\u0010H`\u0002\u0000\u0000\u0000","port":135,"service":"msrpc","service_label_fr":"MSRPC"},"protocol_summary_fr":"Payload \u0005\u0000\u000b\u0003\u0010\u0000\u0000\u0000H\u0000\u0000\u0000\u0001\u0000\u0000\u0000\ufffd\u000f\ufffd\u000f\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\ufffd\ufffd\ufffd\u001f]\ufffd\u0011\ufffd\ufffd\b\u0000+\u0014\ufffd\ufffd\u0003\u0000\u0000\u0000\u0004]\ufffd\ufffd\ufffd\u001c\ufffd\u0011\ufffd\ufffd\b\u2026 \u00b7 MSRPC:135","evidence_snippet":"H\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd+\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+H`","target_port_label":"135 \u00b7 MSRPC","emulator_service":"msrpc","confidence_reason":"Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes","classification_reason":"Type \u00ab port_135_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","classification_reason_label_fr":"Type \u00ab port_135_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence_factors_fr":"Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8","payload_preview":"H\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd+\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+H`"},"events":[{"id":12718103,"ip":"47.239.31.0","ts":"2026-07-18 03:54:40.000000","proto":"tcp","src_port":37974,"dst_port":135,"service":"msrpc","classification":"msrpc","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f74206d7372706320726561647920706f72743d3133350d0a\u0022, \u0022emulator_response_len\u0022: 35, \u0022bytes_in\u0022: 72, \u0022payload_entropy\u0022: 3.8147688091526453, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022msrpc\u0022, \u0022app_proto\u0022: \u0022msrpc\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 135, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 5, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00224ca75bafedc497ca4fec409b1a394b80b467a571\u0022, \u0022event_fingerprint\u0022: \u0022ee04cb302187f8727d545b1eea4782a6fc19fb64\u0022, \u0022classification_confidence\u0022: 0.58, \u0022confidence\u0022: 0.58, \u0022precision_signals\u0022: [\u0022pat-0771\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab msrpc \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 5, \u0022correlation_boost\u0022: 8}, \u0022service_name\u0022: \u0022msrpc\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222878766a3e5ff5cdbb473106561c90e6\u0022, \u0022path_pattern_hash\u0022: \u0022c6bb1b0669e2a6bc71d00031b3cf7c54\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 135, \u0022service\u0022: \u0022msrpc\u0022, \u0022service_name\u0022: \u0022msrpc\u0022, \u0022risk_score\u0022: 5}, \u0022payload_preview\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000H\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\ufffd\\u0010\ufffd\\u0010\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\ufffd\ufffd\ufffd\ufffd`R\\u001b\\u0010\ufffd\ufffd\\u0000\ufffd\\u0000!4z\\u0000\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000H\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\ufffd\\u0010\ufffd\\u0010\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\ufffd\ufffd\ufffd\ufffd`R\\u001b\\u0010\ufffd\ufffd\\u0000\ufffd\\u0000!4z\\u0000\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000H\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\ufffd\\u0010\ufffd\\u0010\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\ufffd\ufffd\ufffd\ufffd`R\\u001b\\u0010\ufffd\ufffd\\u0000\ufffd\\u0000!4z\\u0000\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000H\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\ufffd\\u0010\ufffd\\u0010\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\ufffd\ufffd\ufffd\ufffd`R\\u001b\\u0010\ufffd\ufffd\\u0000\ufffd\\u0000!4z\\u0000\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000H\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\ufffd\\u0010\ufffd\\u0010\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\ufffd\ufffd\ufffd\ufffd`R\\u001b\\u0010\ufffd\ufffd\\u0000\ufffd\\u0000!4z\\u0000\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab msrpc \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002209d84a60caaa3322eaa64d4e77ce6d2b5dcebadd\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000H\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\ufffd\\u0010\ufffd\\u0010\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\ufffd\ufffd\ufffd\ufffd`R\\u001b\\u0010\ufffd\ufffd\\u0000\ufffd\\u0000!4z\\u0000\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 135, \u0022service\u0022: \u0022msrpc\u0022, \u0022service_label_fr\u0022: \u0022MSRPC\u0022}, \u0022evidence_snippet\u0022: \u0022H\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`R\ufffd\ufffd\ufffd!4z]\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+H`\u0022, \u0022attack_vector\u0022: \u0022msrpc \u00b7 via MSRPC:135 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022135 \u00b7 MSRPC\u0022, \u0022emulator_service\u0022: \u0022msrpc\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab msrpc \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab msrpc \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 5, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 5, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022msrpc\u0022, \u0022service_label_fr\u0022: \u0022MSRPC\u0022, \u0022dst_port\u0022: 135, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0771\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0771\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-msrpc\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000H\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\ufffd\\u0010\ufffd\\u0010\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\ufffd\ufffd\ufffd\ufffd`R\\u001b\\u0010\ufffd\ufffd\\u0000\ufffd\\u0000!4z\\u0000\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 135, \u0022service\u0022: \u0022msrpc\u0022, \u0022service_label_fr\u0022: \u0022MSRPC\u0022}, \u0022attack_vector\u0022: \u0022msrpc \u00b7 via MSRPC:135 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022H\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd`R\ufffd\ufffd\ufffd!4z]\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+H`\u0022, \u0022target_port_label\u0022: \u0022135 \u00b7 MSRPC\u0022, \u0022emulator_service\u0022: \u0022msrpc\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022msrpc\u0022, \u0022service_banner\u0022: \u0022honeypot-msrpc\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022135\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 5, \u0022multi_protocol_sample\u0022: [\u0022admin-alt\u0022, \u0022http\u0022, \u0022msrpc\u0022, \u0022personal-agent\u0022, \u0022port:20201\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":72},{"id":12718105,"ip":"47.239.31.0","ts":"2026-07-18 03:54:40.000000","proto":"tcp","src_port":38080,"dst_port":135,"service":"msrpc","classification":"smb_client_elevation","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f74206d7372706320726561647920706f72743d3133350d0a\u0022, \u0022emulator_response_len\u0022: 35, \u0022bytes_in\u0022: 120, \u0022payload_entropy\u0022: 3.2407426725668693, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022msrpc\u0022, \u0022app_proto\u0022: \u0022msrpc\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 135, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 78.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00224ca75bafedc497ca4fec409b1a394b80b467a571\u0022, \u0022event_fingerprint\u0022: \u0022ee04cb302187f8727d545b1eea4782a6fc19fb64\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab smb_client_elevation \u00bb (signaux protocolaires) \u00b7 confiance 65%\u0022, \u0022confidence\u0022: 0.73, \u0022classification_confidence\u0022: 0.73, \u0022precision_score\u0022: 77, \u0022precision_signals\u0022: [\u0022INT-CVE-2025-33073\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-CVE-2025-33073\u0022], \u0022matched_patterns\u0022: [\u0022pat-0837\u0022, \u0022pat-0348\u0022, \u0022pat-0357\u0022, \u0022pat-0369\u0022, \u0022pat-0868\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022NTLM Type1\u0022, \u0022RDP TPKT header\u0022, \u0022Modbus TCP header\u0022, \u0022PostgreSQL startup\u0022, \u0022ET H.323 setup\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0837\u0022, \u0022pat-0348\u0022, \u0022pat-0357\u0022, \u0022pat-0369\u0022, \u0022pat-0868\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022msrpc\u0022, \u0022risk_confidence_factor\u0022: 65.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222012e9ae1ead90cfb687413161487f9f\u0022, \u0022path_pattern_hash\u0022: \u0022704f33e10185a19e150919cb6e2aa45d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 135, \u0022service\u0022: \u0022msrpc\u0022, \u0022service_name\u0022: \u0022msrpc\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000x\\u0000(\\u0000\\u0003\\u0000\\u0000\\u0000\ufffd\\u0010\ufffd\\u0010\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000F\\u0000\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\\n\\u0002\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000NTLMSSP\\u0000\\u0001\\u0000\\u0000\\u0000\\u0007\ufffd\\b\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0006\\u0001\ufffd\\u001d\\u0000\\u0000\\u0000\\u000f\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000x\\u0000(\\u0000\\u0003\\u0000\\u0000\\u0000\ufffd\\u0010\ufffd\\u0010\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000F\\u0000\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\\n\\u0002\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000NTLMSSP\\u0000\\u0001\\u0000\\u0000\\u0000\\u0007\ufffd\\b\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0006\\u0001\ufffd\\u001d\\u0000\\u0000\\u0000\\u000f\u0022, \u0022payload_snippet\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000x\\u0000(\\u0000\\u0003\\u0000\\u0000\\u0000\ufffd\\u0010\ufffd\\u0010\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000F\\u0000\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\\n\\u0002\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000NTLMSSP\\u0000\\u0001\\u0000\\u0000\\u0000\\u0007\ufffd\\b\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0006\\u0001\ufffd\\u001d\\u0000\\u0000\\u0000\\u000f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab smb_client_elevation \u00bb (signaux protocolaires) \u00b7 confiance 65%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f36dd9a3132705cfc201b78817c00f8c0d4ea3ac\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000x\\u0000(\\u0000\\u0003\\u0000\\u0000\\u0000\ufffd\\u0010\ufffd\\u0010\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000F\\u0000\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\\n\\u0002\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000NTLMSSP\\u0000\\u0001\\u0000\\u0000\\u0000\\u0007\ufffd\\b\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0006\\u0001\ufffd\\u001d\\u0000\\u0000\\u0000\\u000f\u0022, \u0022port\u0022: 135, \u0022service\u0022: \u0022msrpc\u0022, \u0022service_label_fr\u0022: \u0022MSRPC\u0022}, \u0022evidence_snippet\u0022: \u0022x(\ufffd\ufffd\ufffd\ufffdF]\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+H`\\nNTLMSSP\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022smb client elevation \u00b7 via MSRPC:135 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022135 \u00b7 MSRPC\u0022, \u0022emulator_service\u0022: \u0022msrpc\u0022, \u0022confidence_reason\u0022: \u0022Confiance 65 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab smb_client_elevation \u00bb (signaux protocolaires) \u00b7 confiance 65%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab smb_client_elevation \u00bb (signaux protocolaires) \u00b7 confiance 65%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 73, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 78.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022msrpc\u0022, \u0022service_label_fr\u0022: \u0022MSRPC\u0022, \u0022dst_port\u0022: 135, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-CVE-2025-33073\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Cve 2025 33073\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-msrpc\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000x\\u0000(\\u0000\\u0003\\u0000\\u0000\\u0000\ufffd\\u0010\ufffd\\u0010\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0001\\u0000\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000F\\u0000\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\\n\\u0002\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000NTLMSSP\\u0000\\u0001\\u0000\\u0000\\u0000\\u0007\ufffd\\b\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0006\\u0001\ufffd\\u001d\\u0000\\u0000\\u0000\\u000f\u0022, \u0022port\u0022: 135, \u0022service\u0022: \u0022msrpc\u0022, \u0022service_label_fr\u0022: \u0022MSRPC\u0022}, \u0022attack_vector\u0022: \u0022smb client elevation \u00b7 via MSRPC:135 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022x(\ufffd\ufffd\ufffd\ufffdF]\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+H`\\nNTLMSSP\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u0022135 \u00b7 MSRPC\u0022, \u0022emulator_service\u0022: \u0022msrpc\u0022, \u0022confidence_reason\u0022: \u0022Confiance 65 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 73 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022msrpc\u0022, \u0022service_banner\u0022: \u0022honeypot-msrpc\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022135\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 5, \u0022multi_protocol_sample\u0022: [\u0022admin-alt\u0022, \u0022http\u0022, \u0022msrpc\u0022, \u0022personal-agent\u0022, \u0022port:20201\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":120},{"id":12718106,"ip":"47.239.31.0","ts":"2026-07-18 03:54:40.000000","proto":"tcp","src_port":38142,"dst_port":135,"service":"msrpc","classification":"port_135_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f74206d7372706320726561647920706f72743d3133350d0a\u0022, \u0022emulator_response_len\u0022: 35, \u0022bytes_in\u0022: 72, \u0022payload_entropy\u0022: 3.9183178789153676, \u0022port_category\u0022: \u0022well_known\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022msrpc\u0022, \u0022app_proto\u0022: \u0022msrpc\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 135, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00224ca75bafedc497ca4fec409b1a394b80b467a571\u0022, \u0022event_fingerprint\u0022: \u0022ee04cb302187f8727d545b1eea4782a6fc19fb64\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_135_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.57, \u0022classification_confidence\u0022: 0.57, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0348\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0348\u0022], \u0022matched_patterns\u0022: [\u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022rdp_probe\u0022, \u0022service_name\u0022: \u0022msrpc\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228dfa64310720c5e668c3a8a9e1d1ce18\u0022, \u0022path_pattern_hash\u0022: \u0022cd80ac7920c162f2bb3df3b8302b6872\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 135, \u0022service\u0022: \u0022msrpc\u0022, \u0022service_name\u0022: \u0022msrpc\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000H\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\ufffd\\u000f\ufffd\\u000f\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\b\ufffd\ufffd\ufffd\\u001f]\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0014\ufffd\ufffd\\u0003\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\u0022, \u0022request_sample\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000H\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\ufffd\\u000f\ufffd\\u000f\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\b\ufffd\ufffd\ufffd\\u001f]\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0014\ufffd\ufffd\\u0003\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000H\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\ufffd\\u000f\ufffd\\u000f\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\b\ufffd\ufffd\ufffd\\u001f]\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0014\ufffd\ufffd\\u0003\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000H\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\ufffd\\u000f\ufffd\\u000f\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\b\ufffd\ufffd\ufffd\\u001f]\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0014\ufffd\ufffd\\u0003\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000H\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\ufffd\\u000f\ufffd\\u000f\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\b\ufffd\ufffd\ufffd\\u001f]\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0014\ufffd\ufffd\\u0003\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_135_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221d5755de2692702f266432e7333f41e1094deca5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000H\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\ufffd\\u000f\ufffd\\u000f\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\b\ufffd\ufffd\ufffd\\u001f]\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0014\ufffd\ufffd\\u0003\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 135, \u0022service\u0022: \u0022msrpc\u0022, \u0022service_label_fr\u0022: \u0022MSRPC\u0022}, \u0022evidence_snippet\u0022: \u0022H\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd+\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+H`\u0022, \u0022attack_vector\u0022: \u0022port 135 tcp \u00b7 via MSRPC:135 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u0022135 \u00b7 MSRPC\u0022, \u0022emulator_service\u0022: \u0022msrpc\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_135_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_135_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 57, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022msrpc\u0022, \u0022service_label_fr\u0022: \u0022MSRPC\u0022, \u0022dst_port\u0022: 135, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0348\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0348\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-msrpc\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0005\\u0000\\u000b\\u0003\\u0010\\u0000\\u0000\\u0000H\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\ufffd\\u000f\ufffd\\u000f\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0001\\u0000\\b\ufffd\ufffd\ufffd\\u001f]\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0014\ufffd\ufffd\\u0003\\u0000\\u0000\\u0000\\u0004]\ufffd\ufffd\ufffd\\u001c\ufffd\\u0011\ufffd\ufffd\\b\\u0000+\\u0010H`\\u0002\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 135, \u0022service\u0022: \u0022msrpc\u0022, \u0022service_label_fr\u0022: \u0022MSRPC\u0022}, \u0022attack_vector\u0022: \u0022port 135 tcp \u00b7 via MSRPC:135 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022H\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffd\ufffd\ufffd+\ufffd\ufffd]\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+H`\u0022, \u0022target_port_label\u0022: \u0022135 \u00b7 MSRPC\u0022, \u0022emulator_service\u0022: \u0022msrpc\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022msrpc\u0022, \u0022service_banner\u0022: \u0022honeypot-msrpc\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u0022135\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 5, \u0022multi_protocol_sample\u0022: [\u0022admin-alt\u0022, \u0022http\u0022, \u0022msrpc\u0022, \u0022personal-agent\u0022, \u0022port:20201\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":72},{"id":12717819,"ip":"47.239.31.0","ts":"2026-07-18 03:50:57.000000","proto":"tcp","src_port":46512,"dst_port":20201,"service":"http","classification":"port_scan_syn","waf_score":14,"waf_tags":"[\u0022950318:lfi-14\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/favicon.ico","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022ico\u0022, \u0022http_ua_hash\u0022: \u002283604a90c7a23c1d603736fc2f150a136e3f394c\u0022, \u0022http_host_hash\u0022: \u002232f9bccd1079f462d85a1b757c38a4457ac3a7ce\u0022, \u0022http_target_hash\u0022: \u0022a40fba6620dee3abd15532f18848dacb6bb80f01\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 142, \u0022payload_entropy\u0022: 5.206764134432318, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 20201, \u0022risk_waf\u0022: 64.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 25.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 41, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b952ba71f02bd25561313cefdd8732121c4b3706\u0022, \u0022event_fingerprint\u0022: \u00221007427a477c839704a155ffdeefc3803c6dc10f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.58, \u0022classification_confidence\u0022: 0.58, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 41, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00229b1e6fe1ce2bd83b65910b33e8a2019f\u0022, \u0022payload_hash\u0022: \u00228fc7ca7c2ae94376896f7e2c397a0084\u0022, \u0022path_pattern_hash\u0022: \u0022b18036488649e7cc8a55b0a02c8b737a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20201, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 41}, \u0022payload_preview\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:20201\\r\\nUser-Agent: Openwave\/ UCWEB7.0.2.37\/28\/999\\r\\nAccept: *\/*\\r\\nAccept-Encoding: def\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/favicon.ico\u0022, \u0022user_agent\u0022: \u0022Openwave\/ UCWEB7.0.2.37\/28\/999\u0022, \u0022waf_tags\u0022: [\u0022950318:lfi-14\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/favicon.ico HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:20201\\r\\nUser-Agent: Openwave\/ UCWEB7.0.2.37\/28\/999\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:20201\\r\\nUser-Agent: Openwave\/ UCWEB7.0.2.37\/28\/999\\r\\nAccept: *\/*\\r\\nAccept-Encoding: def\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/favicon.ico\u0022, \u0022user_agent\u0022: \u0022Openwave\/ UCWEB7.0.2.37\/28\/999\u0022, \u0022waf_tags\u0022: [\u0022950318:lfi-14\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/favicon.ico HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:20201\\r\\nUser-Agent: Openwave\/ UCWEB7.0.2.37\/28\/999\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:20201\\r\\nUser-Agent: Openwave\/ UCWEB7.0.2.37\/28\/999\\r\\nAccept: *\/*\\r\\nAccept-Encoding: def\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002277ae6e99e1c93ef43f495cb07749ef3f5c5859ce\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/favicon.ico\u0022, \u0022request_line\u0022: \u0022GET \/favicon.ico HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Openwave\/ UCWEB7.0.2.37\/28\/999\u0022, \u0022port\u0022: 20201, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:20201\\r\\nUser-Agent: Openwave\/ UCWEB7.0.2.37\/28\/999\\r\\nAccept: *\/*\\r\\nAccept-Encoding: def\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20201 \u00b7 (reconnaissance) \u00b7 \u2192 \/favicon.ico\u0022, \u0022target_port_label\u0022: \u002220201 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 41\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (6 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 64.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 41, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 41, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 20201, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/favicon.ico\u0022, \u0022request_line\u0022: \u0022GET \/favicon.ico HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Openwave\/ UCWEB7.0.2.37\/28\/999\u0022, \u0022port\u0022: 20201, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20201 \u00b7 (reconnaissance) \u00b7 \u2192 \/favicon.ico\u0022, \u0022evidence_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:20201\\r\\nUser-Agent: Openwave\/ UCWEB7.0.2.37\/28\/999\\r\\nAccept: *\/*\\r\\nAccept-Encoding: def\u0022, \u0022target_port_label\u0022: \u002220201 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 64 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220201\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 6, \u0022multi_protocol_sample\u0022: [\u0022admin-alt\u0022, \u0022cloudflare-tunnel\u0022, \u0022http\u0022, \u0022https\u0022, \u0022personal-agent\u0022, \u0022port:20201\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950318:lfi-14\u0022, \u0022950470:nosqli-3\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:20201","http_user_agent":"Openwave\/ UCWEB7.0.2.37\/28\/999","http_referer":null,"tags":"[\u0022950318:lfi-14\u0022, \u0022950470:nosqli-3\u0022]","anomalies":"[]","severity":8,"bytes_in":142},{"id":12717816,"ip":"47.239.31.0","ts":"2026-07-18 03:50:56.000000","proto":"tcp","src_port":46452,"dst_port":20201,"service":null,"classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 610, \u0022payload_entropy\u0022: 4.241705362170746, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 20201, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d920cd10f3aff7e4bc84c6ec88dc04363ab3c5c\u0022, \u0022event_fingerprint\u0022: \u00229d70992ae9ed43e54c45b4a72dda5952e1569a59\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0794\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022matched_pattern_names\u0022: [\u0022Sigma DNP3 link\u0022, \u0022RDP TPKT header\u0022, \u0022ET H.323 setup\u0022, \u0022Minecraft varint handshake\u0022], \u0022pattern_ids\u0022: [\u0022pat-0794\u0022, \u0022pat-0348\u0022, \u0022pat-0868\u0022, \u0022pat-0554\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00227d3587032b33d30b8978ddc3a10bd429\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20201, \u0022risk_score\u0022: 42}, \u0022payload_snippet\u0022: \u0022\\u0005d\\u0005\ufffd\\u0000\\u0000\\u0000\\u00006L\\u0005d\\u0005\ufffd\\u0001\\u0000\\u0000\\u0000\u078e\\u0005d\\u0005\ufffd\\u0002\\u0000\\u0000\\u0000\ufffd\ufffd\\u0005d\\u0005\ufffd\\u0003\\u0000\\u0000\\u0000wF\\u0005d\\u0005\ufffd\\u0004\\u0000\\u0000\\u0000\\u001d\ufffd\\u0005d\\u0005\ufffd\\u0005\\u0000\\u0000\\u0000\ufffdR\\u0005d\\u0005\ufffd\\u0006\\u0000\\u0000\\u0000\ufffdX\\u0005d\\u0005\ufffd\\u0007\\u0000\\u0000\\u0000\\\\\ufffd\\u0005d\\u0005\ufffd\\b\\u0000\\u0000\\u0000\\u0019\ufffd\\u0005d\\u0005\ufffd\\t\\u0000\\u0000\\u0000\ufffd{\\u0005d\\u0005\ufffd\\n\\u0000\\u0000\\u0000\ufffdq\\u0005d\\u0005\ufffd\\u000b\\u0000\\u0000\\u0000X\ufffd\\u0005d\\u0005\ufffd\\f\\u0000\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0005d\\u0005\ufffd\\u0000\\u0000\\u0000\\u00006L\\u0005d\\u0005\ufffd\\u0001\\u0000\\u0000\\u0000\u078e\\u0005d\\u0005\ufffd\\u0002\\u0000\\u0000\\u0000\ufffd\ufffd\\u0005d\\u0005\ufffd\\u0003\\u0000\\u0000\\u0000wF\\u0005d\\u0005\ufffd\\u0004\\u0000\\u0000\\u0000\\u001d\ufffd\\u0005d\\u0005\ufffd\\u0005\\u0000\\u0000\\u0000\ufffdR\\u0005d\\u0005\ufffd\\u0006\\u0000\\u0000\\u0000\ufffdX\\u0005d\\u0005\ufffd\\u0007\\u0000\\u0000\\u0000\\\\\ufffd\\u0005d\\u0005\ufffd\\b\\u0000\\u0000\\u0000\\u0019\ufffd\\u0005d\\u0005\ufffd\\t\\u0000\\u0000\\u0000\ufffd{\\u0005d\\u0005\ufffd\\n\\u0000\\u0000\\u0000\ufffdq\\u0005d\\u0005\ufffd\\u000b\\u0000\\u0000\\u0000X\ufffd\\u0005d\\u0005\ufffd\\f\\u0000\\u0000\\u00002e\\u0005d\\u0005\ufffd\\r\\u0000\\u0000\\u0000\u06a7\\u0005d\\u0005\ufffd\\u000e\\u0000\\u0000\\u0000\ufffd\ufffd\\u0005d\\u0005\ufffd\\u000f\\u0000\\u0000\\u0000so\\u0005d\\u0005\ufffd\\u0010\\u0000\\u0000\\u0000\\u0011\ufffd\\u0005d\\u0005\ufffd\\u0011\\u0000\\u0000\\u0000\ufffd)\\u0005d\\u0005\ufffd\\u0012\\u0000\\u0000\\u0000\ufffd#\\u0005d\\u0005\ufffd\\u0013\\u0000\\u0000\\u0000P\ufffd\\u0005d\\u0005\ufffd\\u0014\\u0000\\u0000\\u0000:7\\u0005d\\u0005\ufffd\\u0015\\u0000\\u0000\\u0000\ufffd\ufffd\\u0005d\\u0005\ufffd\\u0016\\u0000\\u0000\\u0000\ufffd\ufffd\\u0005d\\u0005\ufffd\\u0017\\u0000\\u0000\\u0000{=\\u0005d\\u0005\ufffd\\u0018\\u0000\\u0000\\u0000\u003E\\u001e\\u0005d\\u0005\ufffd\\u0019\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0005d\\u0005\ufffd\\u0000\\u0000\\u0000\\u00006L\\u0005d\\u0005\ufffd\\u0001\\u0000\\u0000\\u0000\u078e\\u0005d\\u0005\ufffd\\u0002\\u0000\\u0000\\u0000\ufffd\ufffd\\u0005d\\u0005\ufffd\\u0003\\u0000\\u0000\\u0000wF\\u0005d\\u0005\ufffd\\u0004\\u0000\\u0000\\u0000\\u001d\ufffd\\u0005d\\u0005\ufffd\\u0005\\u0000\\u0000\\u0000\ufffdR\\u0005d\\u0005\ufffd\\u0006\\u0000\\u0000\\u0000\ufffdX\\u0005d\\u0005\ufffd\\u0007\\u0000\\u0000\\u0000\\\\\ufffd\\u0005d\\u0005\ufffd\\b\\u0000\\u0000\\u0000\\u0019\ufffd\\u0005d\\u0005\ufffd\\t\\u0000\\u0000\\u0000\ufffd{\\u0005d\\u0005\ufffd\\n\\u0000\\u0000\\u0000\ufffdq\\u0005d\\u0005\ufffd\\u000b\\u0000\\u0000\\u0000X\ufffd\\u0005d\\u0005\ufffd\\f\\u0000\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022af5e7a7d59924001f54e06e37203f99b3703dc61\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0005d\\u0005\ufffd\\u0000\\u0000\\u0000\\u00006L\\u0005d\\u0005\ufffd\\u0001\\u0000\\u0000\\u0000\u078e\\u0005d\\u0005\ufffd\\u0002\\u0000\\u0000\\u0000\ufffd\ufffd\\u0005d\\u0005\ufffd\\u0003\\u0000\\u0000\\u0000wF\\u0005d\\u0005\ufffd\\u0004\\u0000\\u0000\\u0000\\u001d\ufffd\\u0005d\\u0005\ufffd\\u0005\\u0000\\u0000\\u0000\ufffdR\\u0005d\\u0005\ufffd\\u0006\\u0000\\u0000\\u0000\ufffdX\\u0005d\\u0005\ufffd\\u0007\\u0000\\u0000\\u0000\\\\\ufffd\\u0005d\\u0005\ufffd\\b\\u0000\\u0000\\u0000\\u0019\ufffd\\u0005d\\u0005\ufffd\\t\\u0000\\u0000\\u0000\ufffd{\\u0005d\\u0005\ufffd\\n\\u0000\\u0000\\u0000\ufffdq\\u0005d\\u0005\ufffd\\u000b\\u0000\\u0000\\u0000X\ufffd\\u0005d\\u0005\ufffd\\f\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 20201}, \u0022evidence_snippet\u0022: \u0022d\ufffd6Ld\ufffd\u078ed\ufffd\ufffd\ufffdd\ufffdwFd\ufffd\ufffdd\ufffd\ufffdRd\ufffd\ufffdXd\ufffd\\\\\ufffdd\ufffd\ufffdd\ufffd\\t\ufffd{d\ufffd\\n\ufffdqd\ufffdX\ufffdd\ufffd\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 20201 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u002220201\u0022, \u0022confidence_reason\u0022: \u0022Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 20201, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0005d\\u0005\ufffd\\u0000\\u0000\\u0000\\u00006L\\u0005d\\u0005\ufffd\\u0001\\u0000\\u0000\\u0000\u078e\\u0005d\\u0005\ufffd\\u0002\\u0000\\u0000\\u0000\ufffd\ufffd\\u0005d\\u0005\ufffd\\u0003\\u0000\\u0000\\u0000wF\\u0005d\\u0005\ufffd\\u0004\\u0000\\u0000\\u0000\\u001d\ufffd\\u0005d\\u0005\ufffd\\u0005\\u0000\\u0000\\u0000\ufffdR\\u0005d\\u0005\ufffd\\u0006\\u0000\\u0000\\u0000\ufffdX\\u0005d\\u0005\ufffd\\u0007\\u0000\\u0000\\u0000\\\\\ufffd\\u0005d\\u0005\ufffd\\b\\u0000\\u0000\\u0000\\u0019\ufffd\\u0005d\\u0005\ufffd\\t\\u0000\\u0000\\u0000\ufffd{\\u0005d\\u0005\ufffd\\n\\u0000\\u0000\\u0000\ufffdq\\u0005d\\u0005\ufffd\\u000b\\u0000\\u0000\\u0000X\ufffd\\u0005d\\u0005\ufffd\\f\\u0000\\u0000\\u0000\u0022, \u0022port\u0022: 20201}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 20201 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022d\ufffd6Ld\ufffd\u078ed\ufffd\ufffd\ufffdd\ufffdwFd\ufffd\ufffdd\ufffd\ufffdRd\ufffd\ufffdXd\ufffd\\\\\ufffdd\ufffd\ufffdd\ufffd\\t\ufffd{d\ufffd\\n\ufffdqd\ufffdX\ufffdd\ufffd\u0022, \u0022target_port_label\u0022: \u002220201\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220201\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 6, \u0022multi_protocol_sample\u0022: [\u0022admin-alt\u0022, \u0022cloudflare-tunnel\u0022, \u0022http\u0022, \u0022https\u0022, \u0022personal-agent\u0022, \u0022port:20201\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":610},{"id":12717818,"ip":"47.239.31.0","ts":"2026-07-18 03:50:56.000000","proto":"tcp","src_port":46480,"dst_port":20201,"service":"http","classification":"port_scan_syn","waf_score":24,"waf_tags":"[\u0022950318:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002283604a90c7a23c1d603736fc2f150a136e3f394c\u0022, \u0022http_host_hash\u0022: \u002232f9bccd1079f462d85a1b757c38a4457ac3a7ce\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 197, \u0022payload_entropy\u0022: 5.395400908567689, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 20201, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 25.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.6, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 59, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022de5ca0ce1052b19a9909a5b80636f003a3349e58\u0022, \u0022event_fingerprint\u0022: \u00220cb31649a3e03d3bb9a41b3aaac14fa595c44375\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 59, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00229b1e6fe1ce2bd83b65910b33e8a2019f\u0022, \u0022payload_hash\u0022: \u00223b57e95598dfca33ab0e798f458e5142\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20201, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 59}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:20201\\r\\nUser-Agent: Openwave\/ UCWEB7.0.2.37\/28\/999\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Openwave\/ UCWEB7.0.2.37\/28\/999\u0022, \u0022waf_tags\u0022: [\u0022950318:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:20201\\r\\nUser-Agent: Openwave\/ UCWEB7.0.2.37\/28\/999\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:20201\\r\\nUser-Agent: Openwave\/ UCWEB7.0.2.37\/28\/999\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Openwave\/ UCWEB7.0.2.37\/28\/999\u0022, \u0022waf_tags\u0022: [\u0022950318:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:20201\\r\\nUser-Agent: Openwave\/ UCWEB7.0.2.37\/28\/999\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:20201\\r\\nUser-Agent: Openwave\/ UCWEB7.0.2.37\/28\/999\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a19b66609fb22c1bbd9b77a7e60498a872534682\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Openwave\/ UCWEB7.0.2.37\/28\/999\u0022, \u0022port\u0022: 20201, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:20201\\r\\nUser-Agent: Openwave\/ UCWEB7.0.2.37\/28\/999\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20201 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u002220201 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (6 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 25.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 59, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 59, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 20201, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Openwave\/ UCWEB7.0.2.37\/28\/999\u0022, \u0022port\u0022: 20201, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:20201 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:20201\\r\\nUser-Agent: Openwave\/ UCWEB7.0.2.37\/28\/999\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\u0022, \u0022target_port_label\u0022: \u002220201 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220201\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 6, \u0022multi_protocol_sample\u0022: [\u0022admin-alt\u0022, \u0022cloudflare-tunnel\u0022, \u0022http\u0022, \u0022https\u0022, \u0022personal-agent\u0022, \u0022port:20201\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950318:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:20201","http_user_agent":"Openwave\/ UCWEB7.0.2.37\/28\/999","http_referer":null,"tags":"[\u0022950318:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","anomalies":"[]","severity":10,"bytes_in":197},{"id":12717815,"ip":"47.239.31.0","ts":"2026-07-18 03:50:55.000000","proto":"tcp","src_port":46390,"dst_port":20201,"service":null,"classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 4, \u0022payload_entropy\u0022: 1.5, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 20201, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d920cd10f3aff7e4bc84c6ec88dc04363ab3c5c\u0022, \u0022event_fingerprint\u0022: \u00229d70992ae9ed43e54c45b4a72dda5952e1569a59\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226ce5e83bce8f65c890fae2bc4bd3a7a8\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 20201, \u0022risk_score\u0022: 42}, \u0022payload_preview\u0022: \u0022\\u0005\\u0002\\u0000\\u0002\u0022, \u0022request_sample\u0022: \u0022\\u0005\\u0002\\u0000\\u0002\u0022, \u0022payload_snippet\u0022: \u0022\\u0005\\u0002\\u0000\\u0002\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0005\\u0002\\u0000\\u0002\u0022, \u0022payload_snippet\u0022: \u0022\\u0005\\u0002\\u0000\\u0002\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b6df634877d2f20ab9c7a6fab183439f3af7a7e5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0005\\u0002\\u0000\\u0002\u0022, \u0022port\u0022: 20201}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 20201 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u002220201\u0022, \u0022confidence_reason\u0022: \u0022Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (6 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 20201, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0005\\u0002\\u0000\\u0002\u0022, \u0022port\u0022: 20201}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 20201 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u002220201\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002220201\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 6, \u0022multi_protocol_sample\u0022: [\u0022admin-alt\u0022, \u0022cloudflare-tunnel\u0022, \u0022http\u0022, \u0022https\u0022, \u0022personal-agent\u0022, \u0022port:20201\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":4},{"id":12717800,"ip":"47.239.31.0","ts":"2026-07-18 03:50:45.000000","proto":"tcp","src_port":34426,"dst_port":5555,"service":"personal-agent","classification":"personal-agent","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u002232323020686f6e6579706f7420706572736f6e616c5f6167656e7420726561647920706f72743d353535350d0a\u0022, \u0022emulator_response_len\u0022: 45, \u0022bytes_in\u0022: 16, \u0022payload_entropy\u0022: 2.091917186688699, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022personal-agent\u0022, \u0022app_proto\u0022: \u0022personal-agent\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 5555, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 0.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 4, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022888a6b39853f357075a34073a4e945bdda29b414\u0022, \u0022event_fingerprint\u0022: \u0022d93c6d08fd760998a271a8a23a13788b18b2adca\u0022, \u0022classification_confidence\u0022: 0.58, \u0022confidence\u0022: 0.58, \u0022precision_signals\u0022: [\u0022pat-0532\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab personal-agent \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 4, \u0022correlation_boost\u0022: 8}, \u0022service_name\u0022: \u0022personal-agent\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00220768a69b5df5a25ffcbef1b2fecd0e2c\u0022, \u0022path_pattern_hash\u0022: \u0022e3da19b853113b154539c506fed9fe37\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 5555, \u0022service\u0022: \u0022personal-agent\u0022, \u0022service_name\u0022: \u0022personal-agent\u0022, \u0022risk_score\u0022: 4}, \u0022payload_preview\u0022: \u0022\\u0002\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0010\\u0000\\u0000\\u0000\\u0002\ufffd\\u001b\u0027\u0022, \u0022request_sample\u0022: \u0022\\u0002\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0010\\u0000\\u0000\\u0000\\u0002\ufffd\\u001b\u0027\u0022, \u0022payload_snippet\u0022: \u0022\\u0002\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0010\\u0000\\u0000\\u0000\\u0002\ufffd\\u001b\u0027\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0002\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0010\\u0000\\u0000\\u0000\\u0002\ufffd\\u001b\u0027\u0022, \u0022payload_snippet\u0022: \u0022\\u0002\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0010\\u0000\\u0000\\u0000\\u0002\ufffd\\u001b\u0027\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab personal-agent \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f78595731cbfa47621da863c81b622ac54dd83e7\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0002\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0010\\u0000\\u0000\\u0000\\u0002\ufffd\\u001b\u0027\u0022, \u0022port\u0022: 5555, \u0022service\u0022: \u0022personal-agent\u0022, \u0022service_label_fr\u0022: \u0022PERSONAL AGENT\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\u0027\u0022, \u0022attack_vector\u0022: \u0022personal-agent \u00b7 via PERSONAL AGENT:5555 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00225555 \u00b7 PERSONAL AGENT\u0022, \u0022emulator_service\u0022: \u0022personal-agent\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab personal-agent \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab personal-agent \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 0.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 4, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 4, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022personal-agent\u0022, \u0022service_label_fr\u0022: \u0022PERSONAL AGENT\u0022, \u0022dst_port\u0022: 5555, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0532\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0532\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-personal-agent\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0002\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000\\u0010\\u0000\\u0000\\u0000\\u0002\ufffd\\u001b\u0027\u0022, \u0022port\u0022: 5555, \u0022service\u0022: \u0022personal-agent\u0022, \u0022service_label_fr\u0022: \u0022PERSONAL AGENT\u0022}, \u0022attack_vector\u0022: \u0022personal-agent \u00b7 via PERSONAL AGENT:5555 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\u0027\u0022, \u0022target_port_label\u0022: \u00225555 \u00b7 PERSONAL AGENT\u0022, \u0022emulator_service\u0022: \u0022personal-agent\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022personal_agent\u0022, \u0022service_banner\u0022: \u0022honeypot-personal-agent\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225555\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 5, \u0022multi_protocol_sample\u0022: [\u0022admin-alt\u0022, \u0022cloudflare-tunnel\u0022, \u0022http\u0022, \u0022https\u0022, \u0022personal-agent\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":16},{"id":12717762,"ip":"47.239.31.0","ts":"2026-07-18 03:50:26.000000","proto":"tcp","src_port":50698,"dst_port":9999,"service":"http","classification":"port_scan_syn","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022d5aa09a5b4960053b63715b1678ef3982a6253d3\u0022, \u0022http_host_hash\u0022: \u002283a22baaf629d53e39c79d30e6b18dca9da1a92c\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 286, \u0022payload_entropy\u0022: 5.546260427405681, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 9999, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022aa0d080d5f055349ccfe5818e9c44f4a4640be4f\u0022, \u0022event_fingerprint\u0022: \u002240878c406b78c3c05ae157428aaa7e6fc39c6cac\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 50, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002238d3719cc8768859ecd7ef33965d5714\u0022, \u0022payload_hash\u0022: \u00222b26d4b976ee2a498ee2f62bb4bf56da\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9999, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 50}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:9999\\r\\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, li\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, like Gecko) Chrome\/10.0.648.133 Safari\/534.16\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:9999\\r\\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, like Gecko) Chrome\/10.0.648.133 Safari\/534.16\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nAccept-Language: zh-CN,zh;q=0.9,en;q=0\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:9999\\r\\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, li\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, like Gecko) Chrome\/10.0.648.133 Safari\/534.16\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:9999\\r\\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, like Gecko) Chrome\/10.0.648.133 Safari\/534.16\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nAccept-Language: zh-CN,zh;q=0.9,en;q=0\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:9999\\r\\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, li\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022769a451b206887983af3d26d955b48d7d3dcbefa\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, like Gecko) Chrome\/10.0.648.133 Safari\/534.16\u0022, \u0022port\u0022: 9999, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:9999\\r\\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, li\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:9999 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229999 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 50, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9999, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, like Gecko) Chrome\/10.0.648.133 Safari\/534.16\u0022, \u0022port\u0022: 9999, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:9999 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:9999\\r\\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, li\u0022, \u0022target_port_label\u0022: \u00229999 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229999\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 4, \u0022multi_protocol_sample\u0022: [\u0022admin-alt\u0022, \u0022cloudflare-tunnel\u0022, \u0022http\u0022, \u0022https\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:9999","http_user_agent":"Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, like Gecko) Chrome\/10.0.648.133 Safari\/534.16","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":286},{"id":12717763,"ip":"47.239.31.0","ts":"2026-07-18 03:50:26.000000","proto":"tcp","src_port":50734,"dst_port":9999,"service":"http","classification":"port_scan_syn","waf_score":13,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/favicon.ico","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600\u0022, \u0022emulator_response_len\u0022: 130, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022ico\u0022, \u0022http_ua_hash\u0022: \u0022d5aa09a5b4960053b63715b1678ef3982a6253d3\u0022, \u0022http_host_hash\u0022: \u002283a22baaf629d53e39c79d30e6b18dca9da1a92c\u0022, \u0022http_target_hash\u0022: \u0022a40fba6620dee3abd15532f18848dacb6bb80f01\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 231, \u0022payload_entropy\u0022: 5.418478816605332, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 9999, \u0022risk_waf\u0022: 60.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00229567717f39f4b2b9418f3afa1cd3b0a0dacfbeaa\u0022, \u0022event_fingerprint\u0022: \u0022e22da0ebcb9e8292876bbd33081f1fa7ea29d8c5\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.58, \u0022classification_confidence\u0022: 0.58, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002238d3719cc8768859ecd7ef33965d5714\u0022, \u0022payload_hash\u0022: \u00222c206f7494087f11d865866de021e443\u0022, \u0022path_pattern_hash\u0022: \u0022b18036488649e7cc8a55b0a02c8b737a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9999, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 40}, \u0022payload_preview\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:9999\\r\\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/favicon.ico\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, like Gecko) Chrome\/10.0.648.133 Safari\/534.16\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/favicon.ico HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:9999\\r\\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, like Gecko) Chrome\/10.0.648.133 Safari\/534.16\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:9999\\r\\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/favicon.ico\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, like Gecko) Chrome\/10.0.648.133 Safari\/534.16\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/favicon.ico HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:9999\\r\\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, like Gecko) Chrome\/10.0.648.133 Safari\/534.16\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:9999\\r\\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f9f10c418b6189eee7726e1c2cf097a3e6ec330b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/favicon.ico\u0022, \u0022request_line\u0022: \u0022GET \/favicon.ico HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, like Gecko) Chrome\/10.0.648.133 Safari\/534.16\u0022, \u0022port\u0022: 9999, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:9999\\r\\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:9999 \u00b7 (reconnaissance) \u00b7 \u2192 \/favicon.ico\u0022, \u0022target_port_label\u0022: \u00229999 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 40\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (4 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 9999, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/favicon.ico\u0022, \u0022request_line\u0022: \u0022GET \/favicon.ico HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, like Gecko) Chrome\/10.0.648.133 Safari\/534.16\u0022, \u0022port\u0022: 9999, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:9999 \u00b7 (reconnaissance) \u00b7 \u2192 \/favicon.ico\u0022, \u0022evidence_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:9999\\r\\nUser-Agent: Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16\u0022, \u0022target_port_label\u0022: \u00229999 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229999\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 4, \u0022multi_protocol_sample\u0022: [\u0022admin-alt\u0022, \u0022cloudflare-tunnel\u0022, \u0022http\u0022, \u0022https\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:9999","http_user_agent":"Mozilla\/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit\/534.16 (KHTML, like Gecko) Chrome\/10.0.648.133 Safari\/534.16","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":231},{"id":12717760,"ip":"47.239.31.0","ts":"2026-07-18 03:50:25.000000","proto":"tcp","src_port":50622,"dst_port":9999,"service":"admin-alt","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 7, \u0022payload_entropy\u0022: 2.807354922057604, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022admin-alt\u0022, \u0022app_proto\u0022: \u0022admin-alt\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 9999, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 22.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 0, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022206c95a9eb725a1fc21f04db3e4cf4233b894a69\u0022, \u0022event_fingerprint\u0022: \u0022bdae3a5e708dccdbe307a2861747dd09885f206a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022matched_patterns\u0022: [\u0022pat-0604\u0022], \u0022matched_pattern_names\u0022: [\u0022Java RMI JRMI\u0022], \u0022pattern_ids\u0022: [\u0022pat-0604\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022admin-alt\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d8c49a0f759e2102fb8fa8368049d06a\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 9999, \u0022service\u0022: \u0022admin-alt\u0022, \u0022service_name\u0022: \u0022admin-alt\u0022, \u0022risk_score\u0022: 42}, \u0022payload_preview\u0022: \u0022JRMI\\u0000\\u0002K\u0022, \u0022request_sample\u0022: \u0022JRMI\\u0000\\u0002K\u0022, \u0022payload_snippet\u0022: \u0022JRMI\\u0000\\u0002K\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022JRMI\\u0000\\u0002K\u0022, \u0022payload_snippet\u0022: \u0022JRMI\\u0000\\u0002K\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222dcb208e23e1e20c11870f7139d77a84dc6f4ff4\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022JRMI\\u0000\\u0002K\u0022, \u0022port\u0022: 9999, \u0022service\u0022: \u0022admin-alt\u0022, \u0022service_label_fr\u0022: \u0022ADMIN ALT\u0022}, \u0022evidence_snippet\u0022: \u0022JRMIK\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via ADMIN ALT:9999 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00229999 \u00b7 ADMIN ALT\u0022, \u0022emulator_service\u0022: \u0022admin-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via ADMIN ALT \u2014 multi-protocole (4 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 22.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022admin-alt\u0022, \u0022service_label_fr\u0022: \u0022ADMIN ALT\u0022, \u0022dst_port\u0022: 9999, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-admin-alt\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022JRMI\\u0000\\u0002K\u0022, \u0022port\u0022: 9999, \u0022service\u0022: \u0022admin-alt\u0022, \u0022service_label_fr\u0022: \u0022ADMIN ALT\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via ADMIN ALT:9999 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022JRMIK\u0022, \u0022target_port_label\u0022: \u00229999 \u00b7 ADMIN ALT\u0022, \u0022emulator_service\u0022: \u0022admin-alt\u0022, \u0022confidence_reason\u0022: \u0022Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022admin_alt\u0022, \u0022service_banner\u0022: \u0022honeypot-admin-alt\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00229999\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 4, \u0022multi_protocol_sample\u0022: [\u0022admin-alt\u0022, \u0022cloudflare-tunnel\u0022, \u0022http\u0022, \u0022https\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[]","anomalies":"[]","severity":0,"bytes_in":7},{"id":12717647,"ip":"47.239.31.0","ts":"2026-07-18 03:49:35.000000","proto":"tcp","src_port":56660,"dst_port":10000,"service":"http","classification":"port_scan_syn","waf_score":16,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022]","http_method":"GET","http_target":"\/","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e\u0022, \u0022emulator_response_len\u0022: 126, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 0, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022f4703695a65b239c40e3120c3c1031df6f7d4b3f\u0022, \u0022http_host_hash\u0022: \u002208ba06a3067b7b908f83ce02b0e95a4941ea7cbc\u0022, \u0022http_target_hash\u0022: \u002242099b4af021e53fd8fd4e056c2568d7c2e3ffa8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 282, \u0022payload_entropy\u0022: 5.564370023486679, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 10000, \u0022risk_waf\u0022: 72.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 50, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022a666a2cd1bdd0731726aff8c3cdcc771e10ed53f\u0022, \u0022event_fingerprint\u0022: \u0022270a0905a786b3fca78af9b91b45a2bd11b7f39d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 50, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022097e9503088c7538575a5a77add13f6c\u0022, \u0022payload_hash\u0022: \u00229ce63b04d99e13c82c9e353a9acbac75\u0022, \u0022path_pattern_hash\u0022: \u00228a5edab282632443219e051e4ade2d1d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 10000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 50}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:10000\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Ge\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:10000\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,e\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:10000\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Ge\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022sap-sapcontrol-path\u0022], \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:10000\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,e\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:10000\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Ge\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002235ce7f3adb59b40831bf24c69a29fa263a37a3bc\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36\u0022, \u0022port\u0022: 10000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:10000\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Ge\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:10000 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u002210000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 72.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 50, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 50, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 10000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/\u0022, \u0022request_line\u0022: \u0022GET \/ HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36\u0022, \u0022port\u0022: 10000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:10000 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:10000\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Ge\u0022, \u0022target_port_label\u0022: \u002210000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 72 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002210000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 3, \u0022multi_protocol_sample\u0022: [\u0022cloudflare-tunnel\u0022, \u0022http\u0022, \u0022https\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:10000","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950734:sap-sapcontrol-path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":8,"bytes_in":282},{"id":12717649,"ip":"47.239.31.0","ts":"2026-07-18 03:49:35.000000","proto":"tcp","src_port":56790,"dst_port":10000,"service":"http","classification":"port_scan_syn","waf_score":13,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/favicon.ico","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600\u0022, \u0022emulator_response_len\u0022: 130, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: \u0022ico\u0022, \u0022http_ua_hash\u0022: \u0022f4703695a65b239c40e3120c3c1031df6f7d4b3f\u0022, \u0022http_host_hash\u0022: \u002208ba06a3067b7b908f83ce02b0e95a4941ea7cbc\u0022, \u0022http_target_hash\u0022: \u0022a40fba6620dee3abd15532f18848dacb6bb80f01\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 227, \u0022payload_entropy\u0022: 5.432786553201781, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 10000, \u0022risk_waf\u0022: 60.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 40, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002239dbf59d65cfcca629bfa52f0ec7dd44aa9dc468\u0022, \u0022event_fingerprint\u0022: \u0022a11836e704fbe459e6cfbe766abf700c6f19328c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.58, \u0022classification_confidence\u0022: 0.58, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u0022097e9503088c7538575a5a77add13f6c\u0022, \u0022payload_hash\u0022: \u00225b0bcd595539a99e7499d06fe4eb2196\u0022, \u0022path_pattern_hash\u0022: \u0022b18036488649e7cc8a55b0a02c8b737a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 10000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 40}, \u0022payload_preview\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:10000\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHT\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/favicon.ico\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/favicon.ico HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:10000\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:10000\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHT\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/favicon.ico\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/favicon.ico HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:10000\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:10000\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHT\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022083e4d24a53f3d2492d7ea847f75f34da3d094ad\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/favicon.ico\u0022, \u0022request_line\u0022: \u0022GET \/favicon.ico HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36\u0022, \u0022port\u0022: 10000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:10000\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHT\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:10000 \u00b7 (reconnaissance) \u00b7 \u2192 \/favicon.ico\u0022, \u0022target_port_label\u0022: \u002210000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 40\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 58, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 40, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 40, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 10000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/favicon.ico\u0022, \u0022request_line\u0022: \u0022GET \/favicon.ico HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36\u0022, \u0022port\u0022: 10000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:10000 \u00b7 (reconnaissance) \u00b7 \u2192 \/favicon.ico\u0022, \u0022evidence_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:10000\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHT\u0022, \u0022target_port_label\u0022: \u002210000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 58 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +8 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002210000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 3, \u0022multi_protocol_sample\u0022: [\u0022cloudflare-tunnel\u0022, \u0022http\u0022, \u0022https\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:10000","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":227},{"id":12717639,"ip":"47.239.31.0","ts":"2026-07-18 03:49:32.000000","proto":"tcp","src_port":45106,"dst_port":2053,"service":"cloudflare-tunnel","classification":"xss_attack","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120343034204e6f7420466f756e640d0a5365727665723a20636c6f7564666c6172650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a\u0022, \u0022emulator_response_len\u0022: 65, \u0022bytes_in\u0022: 272, \u0022payload_entropy\u0022: 5.373705870897571, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022app_proto\u0022: \u0022cloudflare-tunnel\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 2053, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 68.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 40.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 39, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00222f1b0715feb2df81fe337850d3122f86250435da\u0022, \u0022event_fingerprint\u0022: \u0022ecf61e9accc2dacac55d45c01f6f6a64e26c6ab4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022confidence\u0022: 0.67, \u0022classification_confidence\u0022: 0.67, \u0022precision_score\u0022: 70, \u0022precision_signals\u0022: [\u0022pat-0284\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0284\u0022], \u0022matched_patterns\u0022: [\u0022pat-0284\u0022, \u0022pat-0103\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 941130\u0022, \u0022LFI Double-dot bypass\u0022], \u0022pattern_ids\u0022: [\u0022pat-0284\u0022, \u0022pat-0103\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022risk_confidence_factor\u0022: 59.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226ddeac15a7f229fdadbdd27450c61970\u0022, \u0022path_pattern_hash\u0022: \u0022e84c630ed8a3a6084c1b662f626e7300\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022risk_score\u0022: 39}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: curl\/7.75.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nReferer: http:\/\/62.\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: curl\/7.75.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nReferer: http:\/\/62.3.50.33:2053\/ -H \\\u0022Accept: text\/html,application\/xhtml+xml,application\/xml\\\u0022\\r\\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: curl\/7.75.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nReferer: http:\/\/62.\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: curl\/7.75.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nReferer: http:\/\/62.3.50.33:2053\/ -H \\\u0022Accept: text\/html,application\/xhtml+xml,application\/xml\\\u0022\\r\\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: curl\/7.75.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nReferer: http:\/\/62.\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ace6daf74d6ffeb9aae5f73b7f0a269b9bda80f0\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: curl\/7.75.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nReferer: http:\/\/62.\u0022, \u0022port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: curl\/7.75.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nReferer: http:\/\/62.\u0022, \u0022attack_vector\u0022: \u0022xss attack \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00222053 \u00b7 CLOUDFLARE TUNNEL\u0022, \u0022emulator_service\u0022: \u0022cloudflare-tunnel\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 39\/100 (Faible) \u2014 MITRE TA0001 \u2014 confiance 67 % \u2014 via CLOUDFLARE TUNNEL \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 67, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 68.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 39, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 39, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022, \u0022dst_port\u0022: 2053, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0284\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0284\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-cloudflare-tunnel\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: curl\/7.75.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nReferer: http:\/\/62.\u0022, \u0022port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022}, \u0022attack_vector\u0022: \u0022xss attack \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: curl\/7.75.0\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nReferer: http:\/\/62.\u0022, \u0022target_port_label\u0022: \u00222053 \u00b7 CLOUDFLARE TUNNEL\u0022, \u0022emulator_service\u0022: \u0022cloudflare-tunnel\u0022, \u0022confidence_reason\u0022: \u0022Confiance 59 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 67 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022cloudflare_tunnel\u0022, \u0022service_banner\u0022: \u0022honeypot-cloudflare-tunnel\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222053\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022cloudflare-tunnel\u0022, \u0022https\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022cloudflare_tunnel_emulated\u0022, \u0022cloudflare_tunnel_payload\u0022, \u0022http_get_probe\u0022, \u0022net_web_probe\u0022], \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 96}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022cloudflare_tunnel_emulated\u0022, \u0022cloudflare_tunnel_payload\u0022, \u0022http_get_probe\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":272},{"id":12717634,"ip":"47.239.31.0","ts":"2026-07-18 03:49:31.000000","proto":"tcp","src_port":45014,"dst_port":2053,"service":"cloudflare-tunnel","classification":"mozi_pattern","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120343034204e6f7420466f756e640d0a5365727665723a20636c6f7564666c6172650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a\u0022, \u0022emulator_response_len\u0022: 65, \u0022bytes_in\u0022: 281, \u0022payload_entropy\u0022: 5.57835853503445, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022app_proto\u0022: \u0022cloudflare-tunnel\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 2053, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 82.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 40.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 2.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 36, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225004ba207ce4d8d47204e0994c4d5fbe107e9847\u0022, \u0022event_fingerprint\u0022: \u0022ecf61e9accc2dacac55d45c01f6f6a64e26c6ab4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.08, \u0022classification_confidence\u0022: 0.08, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 36, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229f1364b6b67819eea2cf59108da142cb\u0022, \u0022path_pattern_hash\u0022: \u0022762d384fab941f6d0c2239f19994f30e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022risk_score\u0022: 36}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022mitre_tactics\u0022: [\u0022TA0011\u0022], \u0022mitre\u0022: \u0022TA0011\u0022, \u0022threat_family\u0022: [\u0022botnet\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220862b833375a6afcffb3e11b5b9f750f02a0981d\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022target_port_label\u0022: \u00222053 \u00b7 CLOUDFLARE TUNNEL\u0022, \u0022emulator_service\u0022: \u0022cloudflare-tunnel\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 5 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 8 % \u2014 via CLOUDFLARE TUNNEL \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 8, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 36, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022attack_stage_label\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022risk_score\u0022: 36, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022, \u0022dst_port\u0022: 2053, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0011\u0022, \u0022mitre_technique\u0022: \u0022TA0011\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-cloudflare-tunnel\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022}, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gec\u0022, \u0022target_port_label\u0022: \u00222053 \u00b7 CLOUDFLARE TUNNEL\u0022, \u0022emulator_service\u0022: \u0022cloudflare-tunnel\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 5 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022command_and_control\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022cloudflare_tunnel\u0022, \u0022service_banner\u0022: \u0022honeypot-cloudflare-tunnel\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222053\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022cloudflare-tunnel\u0022, \u0022https\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022cloudflare_tunnel_emulated\u0022, \u0022cloudflare_tunnel_payload\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022cloudflare_tunnel_emulated\u0022, \u0022cloudflare_tunnel_payload\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":281},{"id":12717636,"ip":"47.239.31.0","ts":"2026-07-18 03:49:31.000000","proto":"tcp","src_port":45068,"dst_port":2053,"service":"cloudflare-tunnel","classification":"mozi_pattern","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120343034204e6f7420466f756e640d0a5365727665723a20636c6f7564666c6172650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a\u0022, \u0022emulator_response_len\u0022: 65, \u0022bytes_in\u0022: 226, \u0022payload_entropy\u0022: 5.4435449069650055, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022app_proto\u0022: \u0022cloudflare-tunnel\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 2053, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 82.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 40.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 2.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 36, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225004ba207ce4d8d47204e0994c4d5fbe107e9847\u0022, \u0022event_fingerprint\u0022: \u0022ecf61e9accc2dacac55d45c01f6f6a64e26c6ab4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.08, \u0022classification_confidence\u0022: 0.08, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 36, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022623f28f809f5b5f12331bb612d60d2fa\u0022, \u0022path_pattern_hash\u0022: \u0022762d384fab941f6d0c2239f19994f30e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022risk_score\u0022: 36}, \u0022payload_preview\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTM\u0022, \u0022request_sample\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTM\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/81.0.4044.122 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTM\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022mitre_tactics\u0022: [\u0022TA0011\u0022], \u0022mitre\u0022: \u0022TA0011\u0022, \u0022threat_family\u0022: [\u0022botnet\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228d825c7b556092ce10b1eebb9260334f02c3be04\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTM\u0022, \u0022port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTM\u0022, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022target_port_label\u0022: \u00222053 \u00b7 CLOUDFLARE TUNNEL\u0022, \u0022emulator_service\u0022: \u0022cloudflare-tunnel\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 5 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 36\/100 (Faible) \u2014 MITRE TA0011 \u2014 confiance 8 % \u2014 via CLOUDFLARE TUNNEL \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 8, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 36, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022attack_stage_label\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022risk_score\u0022: 36, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022, \u0022dst_port\u0022: 2053, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0011\u0022, \u0022mitre_technique\u0022: \u0022TA0011\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-cloudflare-tunnel\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTM\u0022, \u0022port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022}, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:2053\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit\/537.36 (KHTM\u0022, \u0022target_port_label\u0022: \u00222053 \u00b7 CLOUDFLARE TUNNEL\u0022, \u0022emulator_service\u0022: \u0022cloudflare-tunnel\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 5 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022command_and_control\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022cloudflare_tunnel\u0022, \u0022service_banner\u0022: \u0022honeypot-cloudflare-tunnel\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222053\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022cloudflare-tunnel\u0022, \u0022https\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022cloudflare_tunnel_emulated\u0022, \u0022cloudflare_tunnel_payload\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022cloudflare_tunnel_emulated\u0022, \u0022cloudflare_tunnel_payload\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":226},{"id":12717623,"ip":"47.239.31.0","ts":"2026-07-18 03:49:30.000000","proto":"tcp","src_port":44722,"dst_port":2053,"service":"cloudflare-tunnel","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120343034204e6f7420466f756e640d0a5365727665723a20636c6f7564666c6172650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a\u0022, \u0022emulator_response_len\u0022: 65, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.069283149639083, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022app_proto\u0022: \u0022cloudflare-tunnel\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 2053, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022dc5c4af125a614092bbf7942af913f678297e020\u0022, \u0022event_fingerprint\u0022: \u0022ecf61e9accc2dacac55d45c01f6f6a64e26c6ab4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.5, \u0022classification_confidence\u0022: 0.5, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224d83a38018c106475dc082995954ade9\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\u0006\\u0016\\u001csh\ufffd\u0027c\\u001a!\ufffd\u07ea\ufffd\ufffdT%X\ufffd\ufffd\\u0016\ufffd\ufffdDD\u1072\ufffd\ufffd \ufffdP@-@\\u0010\ufffdp\ufffdc\ufffdI\\u001f\ufffd\ufffd#\\\\l\ufffd\\u000b\ufffd\ufffd\ufffdk*\u003Etk\ufffd\ufffd\\u0018\\u000e\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\u0006\\u0016\\u001csh\ufffd\u0027c\\u001a!\ufffd\u07ea\ufffd\ufffdT%X\ufffd\ufffd\\u0016\ufffd\ufffdDD\u1072\ufffd\ufffd \ufffdP@-@\\u0010\ufffdp\ufffdc\ufffdI\\u001f\ufffd\ufffd#\\\\l\ufffd\\u000b\ufffd\ufffd\ufffdk*\u003Etk\ufffd\ufffd\\u0018\\u000e\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\\u0001\ufffd\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u00183t\\u0000\\u0000\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\bhttp\/1.1\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u00001\\u0000\\u0000\\u0000\\r\\u00000\\u0000.\\u0004\\u0003\\u0005\\u0003\\u0006\\u0003\\b\\u0007\\b\\b\\b\\t\\b\\n\\b\\u000b\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0003\\u0003\\u0002\\u0003\\u0003\\u0001\\u0002\\u0001\\u0003\\u0002\\u0002\\u0002\\u0004\\u0002\\u0005\\u0002\\u0006\\u0002\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\\u0003\\u0003\\u0002\\u0003\\u0001\\u0000-\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\u0006\\u0016\\u001csh\ufffd\u0027c\\u001a!\ufffd\u07ea\ufffd\ufffdT%X\ufffd\ufffd\\u0016\ufffd\ufffdDD\u1072\ufffd\ufffd \ufffdP@-@\\u0010\ufffdp\ufffdc\ufffdI\\u001f\ufffd\ufffd#\\\\l\ufffd\\u000b\ufffd\ufffd\ufffdk*\u003Etk\ufffd\ufffd\\u0018\\u000e\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c0d0eec1acc6bc93a21f2fecfc05fca225a11484\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\u0006\\u0016\\u001csh\ufffd\u0027c\\u001a!\ufffd\u07ea\ufffd\ufffdT%X\ufffd\ufffd\\u0016\ufffd\ufffdDD\u1072\ufffd\ufffd \ufffdP@-@\\u0010\ufffdp\ufffdc\ufffdI\\u001f\ufffd\ufffd#\\\\l\ufffd\\u000b\ufffd\ufffd\ufffdk*\u003Etk\ufffd\ufffd\\u0018\\u000e\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\u0022, \u0022port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdsh\ufffd\u0027c!\ufffd\u07ea\ufffd\ufffdT%X\ufffd\ufffd\ufffd\ufffdDD\u1072\ufffd\ufffd \ufffdP@-@\ufffdp\ufffdc\ufffdI\ufffd\ufffd#\\\\l\ufffd\ufffd\ufffd\ufffdk*\u003Etk\ufffd\ufffd0\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\ufffd\\t\ufffd\ufffd\ufffd=\u003C5\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222053 \u00b7 CLOUDFLARE TUNNEL\u0022, \u0022emulator_service\u0022: \u0022cloudflare-tunnel\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022, \u0022dst_port\u0022: 2053, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-cloudflare-tunnel\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\\u0006\\u0016\\u001csh\ufffd\u0027c\\u001a!\ufffd\u07ea\ufffd\ufffdT%X\ufffd\ufffd\\u0016\ufffd\ufffdDD\u1072\ufffd\ufffd \ufffdP@-@\\u0010\ufffdp\ufffdc\ufffdI\\u001f\ufffd\ufffd#\\\\l\ufffd\\u000b\ufffd\ufffd\ufffdk*\u003Etk\ufffd\ufffd\\u0018\\u000e\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\u0022, \u0022port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdsh\ufffd\u0027c!\ufffd\u07ea\ufffd\ufffdT%X\ufffd\ufffd\ufffd\ufffdDD\u1072\ufffd\ufffd \ufffdP@-@\ufffdp\ufffdc\ufffdI\ufffd\ufffd#\\\\l\ufffd\ufffd\ufffd\ufffdk*\u003Etk\ufffd\ufffd0\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\ufffd\\t\ufffd\ufffd\ufffd=\u003C5\/\ufffd\u0022, \u0022target_port_label\u0022: \u00222053 \u00b7 CLOUDFLARE TUNNEL\u0022, \u0022emulator_service\u0022: \u0022cloudflare-tunnel\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022cloudflare_tunnel\u0022, \u0022service_banner\u0022: \u0022honeypot-cloudflare-tunnel\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222053\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022cloudflare-tunnel\u0022, \u0022https\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022cloudflare_tunnel_emulated\u0022, \u0022cloudflare_tunnel_payload\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022cloudflare_tunnel_emulated\u0022, \u0022cloudflare_tunnel_payload\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":517},{"id":12717628,"ip":"47.239.31.0","ts":"2026-07-18 03:49:30.000000","proto":"tcp","src_port":44840,"dst_port":2053,"service":"cloudflare-tunnel","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120343034204e6f7420466f756e640d0a5365727665723a20636c6f7564666c6172650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a\u0022, \u0022emulator_response_len\u0022: 65, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.054607903085787, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022app_proto\u0022: \u0022cloudflare-tunnel\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 2053, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022dc5c4af125a614092bbf7942af913f678297e020\u0022, \u0022event_fingerprint\u0022: \u0022ecf61e9accc2dacac55d45c01f6f6a64e26c6ab4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.5, \u0022classification_confidence\u0022: 0.5, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00220bfa3bcd8014347e02dba5e94890941e\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd@\ufffdx\ufffd\ufffd\ufffd\\u001f\ufffd\ufffd\uaa1b\ufffd!`W\ufffd9\ufffd\\nn#R(^2\\u000e\ufffd4 \ufffdu\\u0015\ufffd\ufffd^[\ufffd\ufffd\ufffd\\u0006 \/\ufffdh\\u0019!mF\u0026\u003C\\u0019\ufffd\\u0002\ufffd\ufffd6\ufffd\ufffda\ufffd\\\u0022\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd@\ufffdx\ufffd\ufffd\ufffd\\u001f\ufffd\ufffd\uaa1b\ufffd!`W\ufffd9\ufffd\\nn#R(^2\\u000e\ufffd4 \ufffdu\\u0015\ufffd\ufffd^[\ufffd\ufffd\ufffd\\u0006 \/\ufffdh\\u0019!mF\u0026\u003C\\u0019\ufffd\\u0002\ufffd\ufffd6\ufffd\ufffda\ufffd\\\u0022\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\\u0001\ufffd\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u00183t\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u00001\\u0000\\u0000\\u0000\\r\\u00000\\u0000.\\u0004\\u0003\\u0005\\u0003\\u0006\\u0003\\b\\u0007\\b\\b\\b\\t\\b\\n\\b\\u000b\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0003\\u0003\\u0002\\u0003\\u0003\\u0001\\u0002\\u0001\\u0003\\u0002\\u0002\\u0002\\u0004\\u0002\\u0005\\u0002\\u0006\\u0002\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\\u0003\\u0003\\u0002\\u0003\\u0001\\u0000-\\u0000\\u0002\\u0001\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd@\ufffdx\ufffd\ufffd\ufffd\\u001f\ufffd\ufffd\uaa1b\ufffd!`W\ufffd9\ufffd\\nn#R(^2\\u000e\ufffd4 \ufffdu\\u0015\ufffd\ufffd^[\ufffd\ufffd\ufffd\\u0006 \/\ufffdh\\u0019!mF\u0026\u003C\\u0019\ufffd\\u0002\ufffd\ufffd6\ufffd\ufffda\ufffd\\\u0022\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002223b0d3cb3fbbdd8efc6a1cb6a0d05b97bebb2d9b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd@\ufffdx\ufffd\ufffd\ufffd\\u001f\ufffd\ufffd\uaa1b\ufffd!`W\ufffd9\ufffd\\nn#R(^2\\u000e\ufffd4 \ufffdu\\u0015\ufffd\ufffd^[\ufffd\ufffd\ufffd\\u0006 \/\ufffdh\\u0019!mF\u0026\u003C\\u0019\ufffd\\u0002\ufffd\ufffd6\ufffd\ufffda\ufffd\\\u0022\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\u0022, \u0022port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd@\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffd\uaa1b\ufffd!`W\ufffd9\ufffd\\nn#R(^2\ufffd4 \ufffdu\ufffd\ufffd^[\ufffd\ufffd\ufffd \/\ufffdh!mF\u0026\u003C\ufffd\ufffd\ufffd6\ufffd\ufffda\ufffd\\\u00220\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\ufffd\\t\ufffd\ufffd\ufffd=\u003C5\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222053 \u00b7 CLOUDFLARE TUNNEL\u0022, \u0022emulator_service\u0022: \u0022cloudflare-tunnel\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022, \u0022dst_port\u0022: 2053, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-cloudflare-tunnel\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd@\ufffdx\ufffd\ufffd\ufffd\\u001f\ufffd\ufffd\uaa1b\ufffd!`W\ufffd9\ufffd\\nn#R(^2\\u000e\ufffd4 \ufffdu\\u0015\ufffd\ufffd^[\ufffd\ufffd\ufffd\\u0006 \/\ufffdh\\u0019!mF\u0026\u003C\\u0019\ufffd\\u0002\ufffd\ufffd6\ufffd\ufffda\ufffd\\\u0022\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\u0022, \u0022port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd@\ufffdx\ufffd\ufffd\ufffd\ufffd\ufffd\uaa1b\ufffd!`W\ufffd9\ufffd\\nn#R(^2\ufffd4 \ufffdu\ufffd\ufffd^[\ufffd\ufffd\ufffd \/\ufffdh!mF\u0026\u003C\ufffd\ufffd\ufffd6\ufffd\ufffda\ufffd\\\u00220\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\ufffd\\t\ufffd\ufffd\ufffd=\u003C5\/\ufffd\u0022, \u0022target_port_label\u0022: \u00222053 \u00b7 CLOUDFLARE TUNNEL\u0022, \u0022emulator_service\u0022: \u0022cloudflare-tunnel\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022cloudflare_tunnel\u0022, \u0022service_banner\u0022: \u0022honeypot-cloudflare-tunnel\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222053\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022cloudflare-tunnel\u0022, \u0022https\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022cloudflare_tunnel_emulated\u0022, \u0022cloudflare_tunnel_payload\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022cloudflare_tunnel_emulated\u0022, \u0022cloudflare_tunnel_payload\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":517},{"id":12717632,"ip":"47.239.31.0","ts":"2026-07-18 03:49:30.000000","proto":"tcp","src_port":44952,"dst_port":2053,"service":"cloudflare-tunnel","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120343034204e6f7420466f756e640d0a5365727665723a20636c6f7564666c6172650d0a436f6e74656e742d4c656e6774683a20300d0a0d0a\u0022, \u0022emulator_response_len\u0022: 65, \u0022bytes_in\u0022: 115, \u0022payload_entropy\u0022: 4.964927768279243, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022app_proto\u0022: \u0022cloudflare-tunnel\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 2053, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022dc5c4af125a614092bbf7942af913f678297e020\u0022, \u0022event_fingerprint\u0022: \u0022ecf61e9accc2dacac55d45c01f6f6a64e26c6ab4\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.5, \u0022classification_confidence\u0022: 0.5, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002216420b1adb6374a6cc7b5d5ca239f095\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022, \u0022ja3\u0022: \u0022370bfe45c50a2bbcec8e96b5c9efe8d3\u0022, \u0022ja4\u0022: \u0022f90a3607822a6f956f9a2f7814b66d2b\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 7}, \u0022tls_ja3_hash\u0022: \u0022370bfe45c50a2bbcec8e96b5c9efe8d3\u0022, \u0022tls_ja3\u0022: \u0022770,49162-49172-49161-49171-53-47-255,11-10-13172-16-22-23,29-23-30-25-24,0-1-2\u0022, \u0022tls_ja4_hash\u0022: \u0022f90a3607822a6f956f9a2f7814b66d2b\u0022, \u0022tls_ja4\u0022: \u0022t13d0107_4cdd316d9fed_1e298527d56b\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 7, \u0022target_context\u0022: {\u0022dst_port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000n\\u0001\\u0000\\u0000j\\u0003\\u0002\\u0018H\ufffd\ufffd\ufffdX\ufffd\ufffd\u070a\ufffdi\ufffd\ufffd\ufffd \ufffd\ufffd|\ufffd*\ufffd+\u0428\u02a7|\ufffde\ufffd=\\u0000\\u0000\\u000e\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\\u00003\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u00183t\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000n\\u0001\\u0000\\u0000j\\u0003\\u0002\\u0018H\ufffd\ufffd\ufffdX\ufffd\ufffd\u070a\ufffdi\ufffd\ufffd\ufffd \ufffd\ufffd|\ufffd*\ufffd+\u0428\u02a7|\ufffde\ufffd=\\u0000\\u0000\\u000e\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\\u00003\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u00183t\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000n\\u0001\\u0000\\u0000j\\u0003\\u0002\\u0018H\ufffd\ufffd\ufffdX\ufffd\ufffd\u070a\ufffdi\ufffd\ufffd\ufffd \ufffd\ufffd|\ufffd*\ufffd+\u0428\u02a7|\ufffde\ufffd=\\u0000\\u0000\\u000e\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\\u00003\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u00183t\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002211d1c64682e5a9daab214df523838b03fd50a1ce\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000n\\u0001\\u0000\\u0000j\\u0003\\u0002\\u0018H\ufffd\ufffd\ufffdX\ufffd\ufffd\u070a\ufffdi\ufffd\ufffd\ufffd \ufffd\ufffd|\ufffd*\ufffd+\u0428\u02a7|\ufffde\ufffd=\\u0000\\u0000\\u000e\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\\u00003\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u00183t\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022370bfe45c50a2bbcec8e96b5c9efe8d3\u0022, \u0022tls_ja4\u0022: \u0022f90a3607822a6f956f9a2f7814b66d2b\u0022, \u0022port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022}, \u0022evidence_snippet\u0022: \u0022njH\ufffd\ufffd\ufffdX\ufffd\ufffd\u070a\ufffdi\ufffd\ufffd\ufffd \ufffd\ufffd|\ufffd*\ufffd+\u0428\u02a7|\ufffde\ufffd=\ufffd\\n\ufffd\ufffd\\t\ufffd5\/\ufffd3\\n\\n3t\\thttp\/1.1\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222053 \u00b7 CLOUDFLARE TUNNEL\u0022, \u0022emulator_service\u0022: \u0022cloudflare-tunnel\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022, \u0022dst_port\u0022: 2053, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-cloudflare-tunnel\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000n\\u0001\\u0000\\u0000j\\u0003\\u0002\\u0018H\ufffd\ufffd\ufffdX\ufffd\ufffd\u070a\ufffdi\ufffd\ufffd\ufffd \ufffd\ufffd|\ufffd*\ufffd+\u0428\u02a7|\ufffde\ufffd=\\u0000\\u0000\\u000e\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\\u00003\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u00183t\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022370bfe45c50a2bbcec8e96b5c9efe8d3\u0022, \u0022tls_ja4\u0022: \u0022f90a3607822a6f956f9a2f7814b66d2b\u0022, \u0022port\u0022: 2053, \u0022service\u0022: \u0022cloudflare-tunnel\u0022, \u0022service_label_fr\u0022: \u0022CLOUDFLARE TUNNEL\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via CLOUDFLARE TUNNEL:2053 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022njH\ufffd\ufffd\ufffdX\ufffd\ufffd\u070a\ufffdi\ufffd\ufffd\ufffd \ufffd\ufffd|\ufffd*\ufffd+\u0428\u02a7|\ufffde\ufffd=\ufffd\\n\ufffd\ufffd\\t\ufffd5\/\ufffd3\\n\\n3t\\thttp\/1.1\u0022, \u0022target_port_label\u0022: \u00222053 \u00b7 CLOUDFLARE TUNNEL\u0022, \u0022emulator_service\u0022: \u0022cloudflare-tunnel\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022cloudflare_tunnel\u0022, \u0022service_banner\u0022: \u0022honeypot-cloudflare-tunnel\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222053\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022cloudflare-tunnel\u0022, \u0022https\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022cloudflare_tunnel_emulated\u0022, \u0022cloudflare_tunnel_payload\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022cloudflare_tunnel_emulated\u0022, \u0022cloudflare_tunnel_payload\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":115},{"id":12717600,"ip":"47.239.31.0","ts":"2026-07-18 03:49:17.000000","proto":"tcp","src_port":41652,"dst_port":10443,"service":"https","classification":"mozi_pattern","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 213, \u0022payload_entropy\u0022: 5.397878457481957, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 10443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 82.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 5.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 38, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00223f4b6892caaa1664d1ac856a9bb3343298ca4195\u0022, \u0022event_fingerprint\u0022: \u00220ce879e35222bcf244eb8071cb051f2e9c4aa580\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 38}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022695be127bb0cb33300cefda6903904aa\u0022, \u0022path_pattern_hash\u0022: \u0022762d384fab941f6d0c2239f19994f30e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 10443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 38}, \u0022payload_preview\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Geck\u0022, \u0022request_sample\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/28.0.1500.95 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Geck\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/28.0.1500.95 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Geck\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022mitre_tactics\u0022: [\u0022TA0011\u0022], \u0022mitre\u0022: \u0022TA0011\u0022, \u0022threat_family\u0022: [\u0022botnet\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002271927f3d84c3670646d945ace9d4b9689b893851\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Geck\u0022, \u0022port\u0022: 10443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Geck\u0022, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via HTTPS:10443 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022target_port_label\u0022: \u002210443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 38\/100 (Faible) \u2014 MITRE TA0011 \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 38}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022attack_stage_label\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022risk_score\u0022: 38, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 10443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0011\u0022, \u0022mitre_technique\u0022: \u0022TA0011\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Geck\u0022, \u0022port\u0022: 10443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via HTTPS:10443 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/favicon.ico HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Geck\u0022, \u0022target_port_label\u0022: \u002210443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022command_and_control\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002210443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":213},{"id":12717595,"ip":"47.239.31.0","ts":"2026-07-18 03:49:16.000000","proto":"tcp","src_port":41594,"dst_port":10443,"service":"https","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 115, \u0022payload_entropy\u0022: 5.034492985670547, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 10443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022bf82ed4958219b6801f74213ab3f101ded76679b\u0022, \u0022event_fingerprint\u0022: \u00220ce879e35222bcf244eb8071cb051f2e9c4aa580\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.42, \u0022classification_confidence\u0022: 0.42, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002234086abba2cec3a9d418c8eb5ea2ecba\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022, \u0022ja3\u0022: \u0022370bfe45c50a2bbcec8e96b5c9efe8d3\u0022, \u0022ja4\u0022: \u0022f90a3607822a6f956f9a2f7814b66d2b\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 7}, \u0022tls_ja3_hash\u0022: \u0022370bfe45c50a2bbcec8e96b5c9efe8d3\u0022, \u0022tls_ja3\u0022: \u0022770,49162-49172-49161-49171-53-47-255,11-10-13172-16-22-23,29-23-30-25-24,0-1-2\u0022, \u0022tls_ja4_hash\u0022: \u0022f90a3607822a6f956f9a2f7814b66d2b\u0022, \u0022tls_ja4\u0022: \u0022t13d0107_4cdd316d9fed_1e298527d56b\u0022, \u0022tls_version\u0022: \u00220x0302\u0022, \u0022tls_cipher_count\u0022: 7, \u0022target_context\u0022: {\u0022dst_port\u0022: 10443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000n\\u0001\\u0000\\u0000j\\u0003\\u0002x}\ufffd,\ufffd\u003E\ufbc8\u042cP\\\\\ufffd\ufffdO\ufffd\ufffd@?\ufffd\\u001d\ufffd\\u001fWw\ufffd\ufffd\ufffdB\ufffd\\u0000\\u0000\\u000e\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\\u00003\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u00183t\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000n\\u0001\\u0000\\u0000j\\u0003\\u0002x}\ufffd,\ufffd\u003E\ufbc8\u042cP\\\\\ufffd\ufffdO\ufffd\ufffd@?\ufffd\\u001d\ufffd\\u001fWw\ufffd\ufffd\ufffdB\ufffd\\u0000\\u0000\\u000e\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\\u00003\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u00183t\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000n\\u0001\\u0000\\u0000j\\u0003\\u0002x}\ufffd,\ufffd\u003E\ufbc8\u042cP\\\\\ufffd\ufffdO\ufffd\ufffd@?\ufffd\\u001d\ufffd\\u001fWw\ufffd\ufffd\ufffdB\ufffd\\u0000\\u0000\\u000e\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\\u00003\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u00183t\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223f85c25b1155801a8b3b12330046227f86212c7a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000n\\u0001\\u0000\\u0000j\\u0003\\u0002x}\ufffd,\ufffd\u003E\ufbc8\u042cP\\\\\ufffd\ufffdO\ufffd\ufffd@?\ufffd\\u001d\ufffd\\u001fWw\ufffd\ufffd\ufffdB\ufffd\\u0000\\u0000\\u000e\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\\u00003\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u00183t\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022370bfe45c50a2bbcec8e96b5c9efe8d3\u0022, \u0022tls_ja4\u0022: \u0022f90a3607822a6f956f9a2f7814b66d2b\u0022, \u0022port\u0022: 10443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022njx}\ufffd,\ufffd\u003E\ufbc8\u042cP\\\\\ufffd\ufffdO\ufffd\ufffd@?\ufffd\ufffdWw\ufffd\ufffd\ufffdB\ufffd\ufffd\\n\ufffd\ufffd\\t\ufffd5\/\ufffd3\\n\\n3t\\thttp\/1.1\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:10443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002210443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 42, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 10443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000n\\u0001\\u0000\\u0000j\\u0003\\u0002x}\ufffd,\ufffd\u003E\ufbc8\u042cP\\\\\ufffd\ufffdO\ufffd\ufffd@?\ufffd\\u001d\ufffd\\u001fWw\ufffd\ufffd\ufffdB\ufffd\\u0000\\u0000\\u000e\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\\u00003\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u00183t\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022370bfe45c50a2bbcec8e96b5c9efe8d3\u0022, \u0022tls_ja4\u0022: \u0022f90a3607822a6f956f9a2f7814b66d2b\u0022, \u0022port\u0022: 10443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:10443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022njx}\ufffd,\ufffd\u003E\ufbc8\u042cP\\\\\ufffd\ufffdO\ufffd\ufffd@?\ufffd\ufffdWw\ufffd\ufffd\ufffdB\ufffd\ufffd\\n\ufffd\ufffd\\t\ufffd5\/\ufffd3\\n\\n3t\\thttp\/1.1\u0022, \u0022target_port_label\u0022: \u002210443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 42 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002210443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":115},{"id":12717597,"ip":"47.239.31.0","ts":"2026-07-18 03:49:16.000000","proto":"tcp","src_port":41620,"dst_port":10443,"service":"https","classification":"mozi_pattern","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 268, \u0022payload_entropy\u0022: 5.550333004353094, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 10443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 82.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 5.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 38, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00223f4b6892caaa1664d1ac856a9bb3343298ca4195\u0022, \u0022event_fingerprint\u0022: \u00220ce879e35222bcf244eb8071cb051f2e9c4aa580\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 38}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228559a83cf883abb7712e82f9560b820b\u0022, \u0022path_pattern_hash\u0022: \u0022762d384fab941f6d0c2239f19994f30e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 10443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 38}, \u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/2\u0022, \u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/28.0.1500.95 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/2\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/28.0.1500.95 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: deflate, gzip\\r\\nAccept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-\u0022, \u0022payload_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/2\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022mitre_tactics\u0022: [\u0022TA0011\u0022], \u0022mitre\u0022: \u0022TA0011\u0022, \u0022threat_family\u0022: [\u0022botnet\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227004ecf84dba7a8c4314b975dfdd25bb39568e69\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/2\u0022, \u0022port\u0022: 10443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/2\u0022, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via HTTPS:10443 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022target_port_label\u0022: \u002210443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mozi_pattern \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 38\/100 (Faible) \u2014 MITRE TA0011 \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 82.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 38}, \u0022attack_stage\u0022: \u0022c2\u0022, \u0022attack_stage_label\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022risk_score\u0022: 38, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 10443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0011\u0022, \u0022mitre_technique\u0022: \u0022TA0011\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/2\u0022, \u0022port\u0022: 10443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022mozi pattern \u00b7 via HTTPS:10443 \u00b7 (commande \u0026 contr\u00f4le)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/ HTTP\/1.1\\r\\nHost: 62.3.50.33:10443\\r\\nUser-Agent: Mozilla\/5.0 (Windows NT 6.2) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/2\u0022, \u0022target_port_label\u0022: \u002210443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 4 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022command_and_control\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002210443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022command_and_control\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":268},{"id":12717589,"ip":"47.239.31.0","ts":"2026-07-18 03:49:15.000000","proto":"tcp","src_port":41350,"dst_port":10443,"service":"https","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.073047660654535, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 10443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022bf82ed4958219b6801f74213ab3f101ded76679b\u0022, \u0022event_fingerprint\u0022: \u00220ce879e35222bcf244eb8071cb051f2e9c4aa580\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.42, \u0022classification_confidence\u0022: 0.42, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229b4f5edfb113bbab364f224fcadc3cd4\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 10443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdUd\\r\ufffd\\u001a3\\u0011\ufffdV\ufffd\ufffd\ufffd1\ufffdf\ufffd\ufffd-NJ\ufffd\ufffdD\ufffd\ufffd\ufffdn\ufffd \ufffdD\ufffd\\u0015\ufffd-u\ufffd\ufffd\ufffd\ufffd\ufffdpE.\ufffd7O\ufffd\\u0014f\\u001bqm\ufffd\ufffd\ufffd\\u0018\ufffd\u05bd\ufffd\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdUd\\r\ufffd\\u001a3\\u0011\ufffdV\ufffd\ufffd\ufffd1\ufffdf\ufffd\ufffd-NJ\ufffd\ufffdD\ufffd\ufffd\ufffdn\ufffd \ufffdD\ufffd\\u0015\ufffd-u\ufffd\ufffd\ufffd\ufffd\ufffdpE.\ufffd7O\ufffd\\u0014f\\u001bqm\ufffd\ufffd\ufffd\\u0018\ufffd\u05bd\ufffd\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\\u0001\ufffd\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u00183t\\u0000\\u0000\\u0000\\u0010\\u0000\\u000e\\u0000\\f\\u0002h2\\bhttp\/1.1\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u00001\\u0000\\u0000\\u0000\\r\\u00000\\u0000.\\u0004\\u0003\\u0005\\u0003\\u0006\\u0003\\b\\u0007\\b\\b\\b\\t\\b\\n\\b\\u000b\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0003\\u0003\\u0002\\u0003\\u0003\\u0001\\u0002\\u0001\\u0003\\u0002\\u0002\\u0002\\u0004\\u0002\\u0005\\u0002\\u0006\\u0002\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\\u0003\\u0003\\u0002\\u0003\\u0001\\u0000-\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdUd\\r\ufffd\\u001a3\\u0011\ufffdV\ufffd\ufffd\ufffd1\ufffdf\ufffd\ufffd-NJ\ufffd\ufffdD\ufffd\ufffd\ufffdn\ufffd \ufffdD\ufffd\\u0015\ufffd-u\ufffd\ufffd\ufffd\ufffd\ufffdpE.\ufffd7O\ufffd\\u0014f\\u001bqm\ufffd\ufffd\ufffd\\u0018\ufffd\u05bd\ufffd\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022aa28f300090c49c131f5c51da8b095b8c74b7065\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdUd\\r\ufffd\\u001a3\\u0011\ufffdV\ufffd\ufffd\ufffd1\ufffdf\ufffd\ufffd-NJ\ufffd\ufffdD\ufffd\ufffd\ufffdn\ufffd \ufffdD\ufffd\\u0015\ufffd-u\ufffd\ufffd\ufffd\ufffd\ufffdpE.\ufffd7O\ufffd\\u0014f\\u001bqm\ufffd\ufffd\ufffd\\u0018\ufffd\u05bd\ufffd\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\u0022, \u0022port\u0022: 10443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdUd\\r\ufffd3\ufffdV\ufffd\ufffd\ufffd1\ufffdf\ufffd\ufffd-NJ\ufffd\ufffdD\ufffd\ufffd\ufffdn\ufffd \ufffdD\ufffd\ufffd-u\ufffd\ufffd\ufffd\ufffd\ufffdpE.\ufffd7O\ufffdfqm\ufffd\ufffd\ufffd\ufffd\u05bd\ufffd0\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\ufffd\\t\ufffd\ufffd\ufffd=\u003C5\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:10443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002210443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 42, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 10443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffdUd\\r\ufffd\\u001a3\\u0011\ufffdV\ufffd\ufffd\ufffd1\ufffdf\ufffd\ufffd-NJ\ufffd\ufffdD\ufffd\ufffd\ufffdn\ufffd \ufffdD\ufffd\\u0015\ufffd-u\ufffd\ufffd\ufffd\ufffd\ufffdpE.\ufffd7O\ufffd\\u0014f\\u001bqm\ufffd\ufffd\ufffd\\u0018\ufffd\u05bd\ufffd\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\u0022, \u0022port\u0022: 10443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:10443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdUd\\r\ufffd3\ufffdV\ufffd\ufffd\ufffd1\ufffdf\ufffd\ufffd-NJ\ufffd\ufffdD\ufffd\ufffd\ufffdn\ufffd \ufffdD\ufffd\ufffd-u\ufffd\ufffd\ufffd\ufffd\ufffdpE.\ufffd7O\ufffdfqm\ufffd\ufffd\ufffd\ufffd\u05bd\ufffd0\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\ufffd\\t\ufffd\ufffd\ufffd=\u003C5\/\ufffd\u0022, \u0022target_port_label\u0022: \u002210443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 42 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002210443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":517},{"id":12717594,"ip":"47.239.31.0","ts":"2026-07-18 03:49:15.000000","proto":"tcp","src_port":41508,"dst_port":10443,"service":"https","classification":"minecraft_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 517, \u0022payload_entropy\u0022: 4.035092034797913, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 45102, \u0022country\u0022: \u0022HK\u0022, \u0022dst_port\u0022: 10443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 48.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022bf82ed4958219b6801f74213ab3f101ded76679b\u0022, \u0022event_fingerprint\u0022: \u00220ce879e35222bcf244eb8071cb051f2e9c4aa580\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022confidence\u0022: 0.42, \u0022classification_confidence\u0022: 0.42, \u0022precision_score\u0022: 50, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0554\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SIP TLS ClientHello\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0578\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 42.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HK\u0022, \u0022asn\u0022: 45102, \u0022org\u0022: \u0022Alibaba (US) Technology Co., Ltd.\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022bb911c7cde6af3bf438e1ab0d1166aa5\u0022, \u0022path_pattern_hash\u0022: \u0022796c509ff0514fcb64ff9e5a1c4b51db\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 10443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 45}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffdvJu\\u001a\ufffd\ufffd9\ufffd\ufffd\u00bc\ufffd\ufffd{\ufffd\ufffd\ufffd\\u0012\ufffd\\u0005\ufffd\u07e7qV f\\u0007\ufffd\\u001e\ufffd\\u0014\ufffdJ(\\u00168\\u0017\\u001b\\u001a\ufffdQ\ufffd\ufffd\ufffdu\ufffd,\ufffd\ufffd?\ufffdt\ufffd\u0026i\ufffd\ufffd\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffdvJu\\u001a\ufffd\ufffd9\ufffd\ufffd\u00bc\ufffd\ufffd{\ufffd\ufffd\ufffd\\u0012\ufffd\\u0005\ufffd\u07e7qV f\\u0007\ufffd\\u001e\ufffd\\u0014\ufffdJ(\\u00168\\u0017\\u001b\\u001a\ufffdQ\ufffd\ufffd\ufffdu\ufffd,\ufffd\ufffd?\ufffdt\ufffd\u0026i\ufffd\ufffd\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\\u0001\ufffd\\u0000\\u000b\\u0000\\u0004\\u0003\\u0000\\u0001\\u0002\\u0000\\n\\u0000\\f\\u0000\\n\\u0000\\u001d\\u0000\\u0017\\u0000\\u001e\\u0000\\u0019\\u0000\\u00183t\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0016\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u00001\\u0000\\u0000\\u0000\\r\\u00000\\u0000.\\u0004\\u0003\\u0005\\u0003\\u0006\\u0003\\b\\u0007\\b\\b\\b\\t\\b\\n\\b\\u000b\\b\\u0004\\b\\u0005\\b\\u0006\\u0004\\u0001\\u0005\\u0001\\u0006\\u0001\\u0003\\u0003\\u0002\\u0003\\u0003\\u0001\\u0002\\u0001\\u0003\\u0002\\u0002\\u0002\\u0004\\u0002\\u0005\\u0002\\u0006\\u0002\\u0000+\\u0000\\t\\b\\u0003\\u0004\\u0003\\u0003\\u0003\\u0002\\u0003\\u0001\\u0000-\\u0000\\u0002\\u0001\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffdvJu\\u001a\ufffd\ufffd9\ufffd\ufffd\u00bc\ufffd\ufffd{\ufffd\ufffd\ufffd\\u0012\ufffd\\u0005\ufffd\u07e7qV f\\u0007\ufffd\\u001e\ufffd\\u0014\ufffdJ(\\u00168\\u0017\\u001b\\u001a\ufffdQ\ufffd\ufffd\ufffdu\ufffd,\ufffd\ufffd?\ufffdt\ufffd\u0026i\ufffd\ufffd\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022game_server_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002273253368b89ac6166c764f54698b1f6b8ac43f67\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffdvJu\\u001a\ufffd\ufffd9\ufffd\ufffd\u00bc\ufffd\ufffd{\ufffd\ufffd\ufffd\\u0012\ufffd\\u0005\ufffd\u07e7qV f\\u0007\ufffd\\u001e\ufffd\\u0014\ufffdJ(\\u00168\\u0017\\u001b\\u001a\ufffdQ\ufffd\ufffd\ufffdu\ufffd,\ufffd\ufffd?\ufffdt\ufffd\u0026i\ufffd\ufffd\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\u0022, \u0022port\u0022: 10443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffdvJu\ufffd\ufffd9\ufffd\ufffd\u00bc\ufffd\ufffd{\ufffd\ufffd\ufffd\ufffd\ufffd\u07e7qV f\ufffd\ufffd\ufffdJ(8\ufffdQ\ufffd\ufffd\ufffdu\ufffd,\ufffd\ufffd?\ufffdt\ufffd\u0026i\ufffd\ufffd0\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\ufffd\\t\ufffd\ufffd\ufffd=\u003C5\/\ufffd\u0022, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:10443 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002210443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab minecraft_probe \u00bb (signaux protocolaires) \u00b7 confiance 42%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 42, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 48.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 10443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0002\\u0000\\u0001\\u0000\\u0001\ufffd\\u0003\\u0003\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffdvJu\\u001a\ufffd\ufffd9\ufffd\ufffd\u00bc\ufffd\ufffd{\ufffd\ufffd\ufffd\\u0012\ufffd\\u0005\ufffd\u07e7qV f\\u0007\ufffd\\u001e\ufffd\\u0014\ufffdJ(\\u00168\\u0017\\u001b\\u001a\ufffdQ\ufffd\ufffd\ufffdu\ufffd,\ufffd\ufffd?\ufffdt\ufffd\u0026i\ufffd\ufffd\\u00000\\u0013\\u0002\\u0013\\u0003\\u0013\\u0001\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\\u0014\ufffd\\t\ufffd\\u0013\\u0000\ufffd\\u0000\ufffd\\u0000=\\u0000\u003C\\u00005\\u0000\/\\u0000\ufffd\\u0001\\u0000\u0022, \u0022port\u0022: 10443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022minecraft probe \u00b7 via HTTPS:10443 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd?\ufffd\ufffd\ufffd\ufffdvJu\ufffd\ufffd9\ufffd\ufffd\u00bc\ufffd\ufffd{\ufffd\ufffd\ufffd\ufffd\ufffd\u07e7qV f\ufffd\ufffd\ufffdJ(8\ufffdQ\ufffd\ufffd\ufffdu\ufffd,\ufffd\ufffd?\ufffdt\ufffd\u0026i\ufffd\ufffd0\ufffd,\ufffd0\u0329\u0328\ufffd+\ufffd\/\ufffd$\ufffd(\ufffd#\ufffd\u0027\ufffd\\n\ufffd\ufffd\\t\ufffd\ufffd\ufffd=\u003C5\/\ufffd\u0022, \u0022target_port_label\u0022: \u002210443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 42 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 42 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002210443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_web_probe\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":4,"bytes_in":517}],"total_events":24}