{"ip":"51.118.97.142","exported_at":"2026-07-26T06:34:42+00:00","period_days":30,"metrics":{"events7d":0,"distinct_ports":0,"distinct_classifications":0,"max_severity":null,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":85,"attack_stage":"exploit_attempt","attack_chain_stage":"exploitation","threat_family":["ddos"],"recommended_action":"investigate","confidence":1,"risk_breakdown":{"waf":100,"classification":80,"behavior":0,"geo":40,"protocol":35,"novelty":30},"mitre_tactics":["TA0001","TA0002"],"mitre_technique":"T1499","top_mitre_technique":"T1499","top_mitre_count":1854,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP","campaign_hint_fr":null,"confidence_breakdown":{"waf":100,"classification":80,"behavior":0,"geo":40,"protocol":35,"novelty":30,"risk_score":84},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":100,"confidence_hint_fr":null,"sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["MITRE-T1499"],"tags_summary":["MITRE-T1499"],"attack_vector":"http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/aws%2ephp%2eold","protocol_details":{"http_method":"GET","http_path":"\/aws%2ephp%2eold","request_line":"GET \/aws%2ephp%2eold HTTP\/1.1","http_user_agent":"curl\/8.7.1","port":8028,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"GET \/aws%2ephp%2eold \u00b7 UA curl\/8.7.1 \u00b7 HTTP:8028","evidence_snippet":"GET \/aws%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:8028\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag","target_port_label":"8028 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 100 % \u2014 5 tag(s) WAF","classification_reason":"Sonde fichier sensible \/ config \u00b7 confiance 100%","classification_reason_label_fr":"Sonde fichier sensible \/ config \u00b7 confiance 100%","confidence_factors_fr":"Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF","payload_preview":"GET \/aws%2ephp%2eold HTTP\/1.1\r\nHost: 62.3.50.33:8028\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag"},"events":[{"id":12579713,"ip":"51.118.97.142","ts":"2026-07-16 21:54:02.000000","proto":"tcp","src_port":61854,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/core\/secrets\/config%2ejs","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u002209d6a4c994c1f2cff7878cfe15a3080286fbe608\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.161739394804925, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00223d382806976bfc9757cf51d779eaedaae69d95ae\u0022, \u0022event_fingerprint\u0022: \u0022654dac3141de1a9850b11cdfe5679bfcba2a7356\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022e89aee1548945ba44d7e91f5a32a4e1c\u0022, \u0022path_pattern_hash\u0022: \u002285810599d11150068ef74d98ae0af279\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/secrets\/config%2ejs\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/secrets\/config%2ejs\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b615bd393bc517473f03e73d63f9699fa887b6ff\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/secrets\/config%2ejs\u0022, \u0022request_line\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/secrets\/config%2ejs\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/secrets\/config%2ejs\u0022, \u0022request_line\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/secrets\/config%2ejs\u0022, \u0022evidence_snippet\u0022: \u0022GET \/core\/secrets\/config%2ejs HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12579714,"ip":"51.118.97.142","ts":"2026-07-16 21:54:02.000000","proto":"tcp","src_port":61868,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/test_phpinfo5%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022f203492862c6fba6dff438691931b373b1815a97\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 383, \u0022payload_entropy\u0022: 5.189584534652183, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00227da924cb34c05f05d32708e1f914f63452b70e1c\u0022, \u0022event_fingerprint\u0022: \u0022615ae1cd2613af5cb9f997319b6718f348fe858d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022185bb94e7c9c29b8aae5aa4c4e6e31dc\u0022, \u0022path_pattern_hash\u0022: \u0022a88015c2c876b7ff39d555606930e0ce\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/test_phpinfo5%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/test_phpinfo5%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a13c20a4eecf2d5f680c4aaa834d6b0bea47e99f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/test_phpinfo5%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/test_phpinfo5%2ephp\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/test_phpinfo5%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/test_phpinfo5%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/test_phpinfo5%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":383},{"id":12579715,"ip":"51.118.97.142","ts":"2026-07-16 21:54:02.000000","proto":"tcp","src_port":61870,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/sendgrid_config%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u00222155bd174d1ed45ee2ef50cf65e7c826d5a33ee1\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 390, \u0022payload_entropy\u0022: 5.186078650017211, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002231f77fe7cafa114a8b95f310e10060044e430ed2\u0022, \u0022event_fingerprint\u0022: \u0022a61675eeb01177340c95a98853b11d8e30091cb0\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022ca84a5d56f901958740f141ed0aa2eee\u0022, \u0022path_pattern_hash\u0022: \u0022a4039cc7a913ca3c84f0aa59da2f6b35\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/sendgrid_config%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/sendgrid_config%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002299f78d6189ebee2f2f1306fc587e78facb7b39ae\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/sendgrid_config%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/sendgrid_config%2ejson\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/sendgrid_config%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/sendgrid_config%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/sendgrid_config%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":390},{"id":12579716,"ip":"51.118.97.142","ts":"2026-07-16 21:54:02.000000","proto":"tcp","src_port":61884,"dst_port":8028,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/admin\/static\/debug%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u002262d03db252b7920658fe8de4c5e9c5acd4a1809d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.180673053993151, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 83, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e5e7b1725bd0f6d18118942ac2ccd9ce5bbd1dc4\u0022, \u0022event_fingerprint\u0022: \u0022f07a5ae4541e5201a5249e7e004006710e957f1c\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ET Magento admin\u0022, \u0022ES admin GET\u0022, \u0022ActiveMQ console\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00225808d1fbbf13f45017374965ac2978d2\u0022, \u0022path_pattern_hash\u0022: \u0022dd4374e6396725b4a93e496ab548a1f2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 83}, \u0022payload_preview\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/static\/debug%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/static\/debug%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022590a6391b6fd07668e6ee421ca713be2f648d9eb\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/static\/debug%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/static\/debug%2eenv\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 83\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 83, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/static\/debug%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/static\/debug%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/admin\/static\/debug%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12579717,"ip":"51.118.97.142","ts":"2026-07-16 21:54:02.000000","proto":"tcp","src_port":61890,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/src\/debug%2elog","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022d93981c8b7420d6138ccb6ef0557c8efcff682d3\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.154457734570059, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002269c001e8b0e0483816b970cebe27877929b6a312\u0022, \u0022event_fingerprint\u0022: \u0022547e609c19ae91acc3347ce1b00490f506114ba7\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 941150\u0022, \u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00222f70edb9e7c986ea03081df979ccbb45\u0022, \u0022path_pattern_hash\u0022: \u0022cda7cc188909acc4e69e36a80544397a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/src\/debug%2elog\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/src\/debug%2elog\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e2829a14d154922fec202b537df216e72a1c5a96\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/src\/debug%2elog\u0022, \u0022request_line\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/src\/debug%2elog\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/src\/debug%2elog\u0022, \u0022request_line\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/src\/debug%2elog\u0022, \u0022evidence_snippet\u0022: \u0022GET \/src\/debug%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12579718,"ip":"51.118.97.142","ts":"2026-07-16 21:54:02.000000","proto":"tcp","src_port":61906,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022541f35df5563d54455a41ef0d97f8cde41b7aff9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 403, \u0022payload_entropy\u0022: 5.2360252014855995, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00220c7fe37adc33c6996f2911ab8a12ff26eb10eef0\u0022, \u0022event_fingerprint\u0022: \u002233442d238014edd39d89fd6dde65c6024731bd09\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00226fee5be92f4226d7414865d6ee050cf6\u0022, \u0022path_pattern_hash\u0022: \u002203603d0d578626744a99e336209572c9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022969b9c7ed6924fdaf70f4386a45bd56a3715f292\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eSPirv%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":403},{"id":12579719,"ip":"51.118.97.142","ts":"2026-07-16 21:54:02.000000","proto":"tcp","src_port":61914,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/core\/backup\/db%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u002225e87c690d67344e4c2c90367889c6f2c0981fc4\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 384, \u0022payload_entropy\u0022: 5.178129769019921, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00227d3ab80281d97d36fe55a87137c17871b3faf1b7\u0022, \u0022event_fingerprint\u0022: \u002272167bbd32a6554f126113bc3822c4d4a5c14d16\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00225e1ee1f30ab3cf101e09c5bcf3d53eb2\u0022, \u0022path_pattern_hash\u0022: \u00229003ac5eed01bdea8382e25df338ceeb\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/backup\/db%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/backup\/db%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226744579d78bf3d8842b3809434a9c5325df5bde4\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/backup\/db%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/backup\/db%2eenv\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/backup\/db%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/backup\/db%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/core\/backup\/db%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":384},{"id":12579720,"ip":"51.118.97.142","ts":"2026-07-16 21:54:02.000000","proto":"tcp","src_port":61922,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/tools\/aws%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022651be48e9fdab6a7518117717db25429c13814f0\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.157297330494851, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00220c7fe37adc33c6996f2911ab8a12ff26eb10eef0\u0022, \u0022event_fingerprint\u0022: \u002209489099235658a1230277409eaa199b7dd51bea\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022dd8240f756d379912b2b91db33109ab2\u0022, \u0022path_pattern_hash\u0022: \u0022c2d7238488913a3bf9ab8e03cfbee1e3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/tools\/aws%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/tools\/aws%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a50912ad7db4b267722d6a2c7dc17c456d637702\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/tools\/aws%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/tools\/aws%2eenv\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/tools\/aws%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/tools\/aws%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/tools\/aws%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12579722,"ip":"51.118.97.142","ts":"2026-07-16 21:54:02.000000","proto":"tcp","src_port":61936,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/_nodes\/http","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022ff6b945c65ec0157356b158dad63a07259b32811\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 375, \u0022payload_entropy\u0022: 5.15182731559701, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00220c7fe37adc33c6996f2911ab8a12ff26eb10eef0\u0022, \u0022event_fingerprint\u0022: \u0022f0c3149080c7cf3d577c62096256917288dcd8c2\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0344\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ES nodes API\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0344\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00222a547977f1b45791bbe82d14d1471fca\u0022, \u0022path_pattern_hash\u0022: \u00220b56a35fea8ce0b7c79004682198e73c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/_nodes\/http\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/_nodes\/http\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002259ecb64d2e1c38460c60f1fbb64358940326b3ff\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/_nodes\/http\u0022, \u0022request_line\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/_nodes\/http\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/_nodes\/http\u0022, \u0022request_line\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/_nodes\/http\u0022, \u0022evidence_snippet\u0022: \u0022GET \/_nodes\/http HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":375},{"id":12579724,"ip":"51.118.97.142","ts":"2026-07-16 21:54:02.000000","proto":"tcp","src_port":61944,"dst_port":8028,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/info\/%2eenv%2edist","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u002259b558da015d01f2939764f8733c9dbe19cf209a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 382, \u0022payload_entropy\u0022: 5.164380520972859, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 83, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00221ce5f30650a22e45a69fbd80c13308e3798ade41\u0022, \u0022event_fingerprint\u0022: \u0022343b1a157d4dc914b76c00ebd399416173660759\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002234abc9f832bd7243771ed07dddbc9f06\u0022, \u0022path_pattern_hash\u0022: \u002231e472d70f7d655171121b123169ef03\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 83}, \u0022payload_preview\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info\/%2eenv%2edist\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info\/%2eenv%2edist\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fd94a10bd809b0590a5827248f9a6ff4ba9ecee9\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info\/%2eenv%2edist\u0022, \u0022request_line\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/info\/%2eenv%2edist\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 83\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 83, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info\/%2eenv%2edist\u0022, \u0022request_line\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/info\/%2eenv%2edist\u0022, \u0022evidence_snippet\u0022: \u0022GET \/info\/%2eenv%2edist HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":382},{"id":12579725,"ip":"51.118.97.142","ts":"2026-07-16 21:54:02.000000","proto":"tcp","src_port":61956,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/sql\/login%2ebak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u002276492cdd4ca7da756b3e84beba8e5086c1d473f4\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 386, \u0022payload_entropy\u0022: 5.186302605565432, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022381f510dbcac969e0932f192d3c8788065601780\u0022, \u0022event_fingerprint\u0022: \u0022a80089eaa8919335b98161cd025ed208d537a248\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022ad5b5ccca0cfd65b0dabe37f24de073b\u0022, \u0022path_pattern_hash\u0022: \u0022dbd52cceaf86f6df85e7584a176672f8\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sql\/login%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sql\/login%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f736537baa35a673ff5e77e5eb22e8ed03a2f579\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sql\/login%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sql\/login%2ebak\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sql\/login%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sql\/login%2ebak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/sql\/login%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":386},{"id":12579726,"ip":"51.118.97.142","ts":"2026-07-16 21:54:02.000000","proto":"tcp","src_port":61962,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/aws%2ephp%2eold","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u00227387bb51d5104b879d0e99dc9944d1ea1af5fb99\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.166465215885873, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00221d525326a50f2225cadb028f9cec920f20c27085\u0022, \u0022event_fingerprint\u0022: \u002227dcd1af2988e000a4b8b6c9b84d15eef78a0f9b\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00221b477949580e3996ab5a892d67f581ef\u0022, \u0022path_pattern_hash\u0022: \u00223363573a2f1d6e8551aac742e2f1bbd7\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/aws%2ephp%2eold\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/aws%2ephp%2eold\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227b3941c326ef8e39c144af9c585deab5946508b5\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/aws%2ephp%2eold\u0022, \u0022request_line\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/aws%2ephp%2eold\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/aws%2ephp%2eold\u0022, \u0022request_line\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/aws%2ephp%2eold\u0022, \u0022evidence_snippet\u0022: \u0022GET \/aws%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12579700,"ip":"51.118.97.142","ts":"2026-07-16 21:54:01.000000","proto":"tcp","src_port":61732,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/mail\/smtp_credentials%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022ecf190531f1d21f6ce40d24c8bad12751878839b\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 396, \u0022payload_entropy\u0022: 5.199417840228951, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002231f77fe7cafa114a8b95f310e10060044e430ed2\u0022, \u0022event_fingerprint\u0022: \u0022db4a4c1b6cba96f5eb80bcd970c1bad6ea5dd530\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022dd4892c92cdc96a8d8945751c2c9eeff\u0022, \u0022path_pattern_hash\u0022: \u00229d651ca2ea14b371bc67173f4063211e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/mail\/smtp_credentials%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: \u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/mail\/smtp_credentials%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: \u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222ef27083a47946b8538d464eed31cf23556f77f1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/mail\/smtp_credentials%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/mail\/smtp_credentials%2ejson\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/mail\/smtp_credentials%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/mail\/smtp_credentials%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/mail\/smtp_credentials%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzi\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":396},{"id":12579701,"ip":"51.118.97.142","ts":"2026-07-16 21:54:01.000000","proto":"tcp","src_port":61734,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/db%2emongodump","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u00223c63a8750bc7c2b0a13eb48396b0f7eec9aab1e2\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 378, \u0022payload_entropy\u0022: 5.172475250970435, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00227da924cb34c05f05d32708e1f914f63452b70e1c\u0022, \u0022event_fingerprint\u0022: \u002221b812782ba0fcdc8b74842466718af0b0c70e83\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022d00e2b711cf4ede0516eadd8dac6d53e\u0022, \u0022path_pattern_hash\u0022: \u0022fc4dbf1424f0b82f0d46ec2a174d9965\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/db%2emongodump\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/db%2emongodump\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c8de7d7ac08ae5b45dec144dac95941b900d164c\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/db%2emongodump\u0022, \u0022request_line\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/db%2emongodump\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/db%2emongodump\u0022, \u0022request_line\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/db%2emongodump\u0022, \u0022evidence_snippet\u0022: \u0022GET \/db%2emongodump HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":378},{"id":12579702,"ip":"51.118.97.142","ts":"2026-07-16 21:54:01.000000","proto":"tcp","src_port":61742,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/application%2eproperties%2eorig","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022477cda7c156ae739b0777b9d90df8fa17e6663d7\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 395, \u0022payload_entropy\u0022: 5.146894655215556, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00227da924cb34c05f05d32708e1f914f63452b70e1c\u0022, \u0022event_fingerprint\u0022: \u00222b8c8c5e1d409b4ee1c0613d6c5cee4e4f639036\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00220f4baafe85afd2d0f9ffa92c9dca469d\u0022, \u0022path_pattern_hash\u0022: \u00223eaf164e6a8c4d1d5558c1b9873068ab\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/application%2eproperties%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 1\u0022, \u0022payload_snippet\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/application%2eproperties%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 1\u0022, \u0022payload_snippet\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220402212f7b136450e65a18a97cf9559b5915be28\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/application%2eproperties%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/application%2eproperties%2eorig\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/application%2eproperties%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/application%2eproperties%2eorig\u0022, \u0022evidence_snippet\u0022: \u0022GET \/application%2eproperties%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":395},{"id":12579703,"ip":"51.118.97.142","ts":"2026-07-16 21:54:01.000000","proto":"tcp","src_port":61748,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api-key%2eyml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022b50e237670b086158a8da4c50204316dd18d6d25\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 377, \u0022payload_entropy\u0022: 5.168953509654392, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00227da924cb34c05f05d32708e1f914f63452b70e1c\u0022, \u0022event_fingerprint\u0022: \u00223e25d6fca38260cb553a99ba5caf195da6cc911f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022acc68f18f6d2021b32f7dd732ea68149\u0022, \u0022path_pattern_hash\u0022: \u00228dc423889a8bf4ff9ee47a1f73198c94\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002251c90991fa0f931475386eae7077aa1d88c29770\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key%2eyml\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key%2eyml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api-key%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":377},{"id":12579704,"ip":"51.118.97.142","ts":"2026-07-16 21:54:01.000000","proto":"tcp","src_port":61758,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/terraform\/terraform%2etfstate%2elock%2einfo%2econf","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u00226fbf3fc997393cd26212322e66f14a1fe80724c9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 414, \u0022payload_entropy\u0022: 5.192696844810296, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022276ce83bc4501237ca57a0304481b2c6842f832a\u0022, \u0022event_fingerprint\u0022: \u0022953e0f73e4e1a0db86b94db2a5225daf63b162bd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022cab3a2a778defc0fe5a660945aef9324\u0022, \u0022path_pattern_hash\u0022: \u002265f693b9dd982e63f572314c321f0714\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/terraform\/terraform%2etfstate%2elock%2einfo%2econf\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/terraform\/terraform%2etfstate%2elock%2einfo%2econf\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002251b2d192488144c05b65343175abaeabb12a7aed\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/terraform\/terraform%2etfstate%2elock%2einfo%2econf\u0022, \u0022request_line\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/terraform\/terraform%2etfstate%2elock%2einfo%2e\u2026\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/terraform\/terraform%2etfstate%2elock%2einfo%2econf\u0022, \u0022request_line\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/terraform\/terraform%2etfstate%2elock%2einfo%2e\u2026\u0022, \u0022evidence_snippet\u0022: \u0022GET \/terraform\/terraform%2etfstate%2elock%2einfo%2econf HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_terraform\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_terraform\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":414},{"id":12579705,"ip":"51.118.97.142","ts":"2026-07-16 21:54:01.000000","proto":"tcp","src_port":61774,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/keys\/config%2exml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022b8dd950a420302c535d9efec2409fc43710b349a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.205442229466697, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022447cea6b4f0e0f0a7d82ddbafd178a828abd5710\u0022, \u0022event_fingerprint\u0022: \u00227ce1e23554a96a98cf051fecc51d91c26779b9d0\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00227b5b7eb668a0a7bf10a702e06514e1a9\u0022, \u0022path_pattern_hash\u0022: \u002271bb9e7055c0f5a6a3f2aa9af9f54af3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/keys\/config%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/keys\/config%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002255e91f1e6aa480e14e38924e45e302d492a6b2d9\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/keys\/config%2exml\u0022, \u0022request_line\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/keys\/config%2exml\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/keys\/config%2exml\u0022, \u0022request_line\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/keys\/config%2exml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/keys\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12579706,"ip":"51.118.97.142","ts":"2026-07-16 21:54:01.000000","proto":"tcp","src_port":61778,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/config\/sample%2elog","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u002269e910deab36501fd3dadb45398d2e093d905c9e\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 387, \u0022payload_entropy\u0022: 5.176872769058401, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e822aaa8f7790f0de53176cdb398caba3b255e05\u0022, \u0022event_fingerprint\u0022: \u00224e13af0bc657f071b01ee32b9b0bc32e6fd88b3c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002272b21516019c8c1ebfe95e03936ffb5f\u0022, \u0022path_pattern_hash\u0022: \u0022da152312ca3e7ae29c060a1dc480166f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/config\/sample%2elog\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/config\/sample%2elog\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002216aaf937d6cc4e1d98929e89ce463321f6a87a44\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/config\/sample%2elog\u0022, \u0022request_line\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/config\/sample%2elog\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/config\/sample%2elog\u0022, \u0022request_line\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/config\/sample%2elog\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/config\/sample%2elog HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":387},{"id":12579707,"ip":"51.118.97.142","ts":"2026-07-16 21:54:01.000000","proto":"tcp","src_port":61788,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/wp-content\/backup\/dbdump%2esql","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022dce844ddad552756948d90ddf939523f6ea20489\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 394, \u0022payload_entropy\u0022: 5.204843890224246, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022af0970d0f0d1295ecfed3111cd01356b2107501d\u0022, \u0022event_fingerprint\u0022: \u00220f4cc3abaf76f456c1638cc858f7fec8eac659af\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022d5b71e04e99be5b036b74472c74fa08b\u0022, \u0022path_pattern_hash\u0022: \u002246401f3dea5961de30c238b6950848a9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-content\/backup\/dbdump%2esql\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 12\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-content\/backup\/dbdump%2esql\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 12\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002252fc55ab1258288f6d8765343b4714af9a511f05\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-content\/backup\/dbdump%2esql\u0022, \u0022request_line\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/wp-content\/backup\/dbdump%2esql\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-content\/backup\/dbdump%2esql\u0022, \u0022request_line\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/wp-content\/backup\/dbdump%2esql\u0022, \u0022evidence_snippet\u0022: \u0022GET \/wp-content\/backup\/dbdump%2esql HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":394},{"id":12579708,"ip":"51.118.97.142","ts":"2026-07-16 21:54:01.000000","proto":"tcp","src_port":61802,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/private\/ses%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022f47395e56d3d527db1e3f890f0c3e5ff743b1c96\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 381, \u0022payload_entropy\u0022: 5.153280701871282, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002293d69073d3cc5f59cf4a360c2e40d927b0c38df6\u0022, \u0022event_fingerprint\u0022: \u0022b397e6c57a8e0e0646dc903eaf9ee282e80daefc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022ec7c23ec9644e356f81732f170afd3bb\u0022, \u0022path_pattern_hash\u0022: \u0022e3edf72b89e306a325c47fe5b53531f3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/private\/ses%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue\u0022, \u0022payload_snippet\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/private\/ses%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue\u0022, \u0022payload_snippet\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225230125f85c9dc3490585f873619fe480fb60a69\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/private\/ses%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/private\/ses%2eenv\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/private\/ses%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/private\/ses%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/private\/ses%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_private\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_private\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":381},{"id":12579709,"ip":"51.118.97.142","ts":"2026-07-16 21:54:01.000000","proto":"tcp","src_port":61814,"dst_port":8028,"service":"http","classification":"config_file_probe","waf_score":32,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/wp-admin\/network\/ms-plugins%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022d0604bd294cc12c0955a581beca19967e6c52875\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 397, \u0022payload_entropy\u0022: 5.200928596289289, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 83, \u0022tag_count\u0022: 21, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002291e99f1a8ede37d3bb771943487fc43d8a2a14b8\u0022, \u0022event_fingerprint\u0022: \u00229e098405625eda31600d50e2adab1d0659eddbf9\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022295ca564a857f72d432b239d403bba1e\u0022, \u0022path_pattern_hash\u0022: \u0022e122959fd1e06d1c49586e746fa1e004\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 83}, \u0022payload_preview\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022cms-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP:\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022cms-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP:\u0022, \u0022payload_snippet\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002263f1585df6c934a5869e601c0f3ca575b6d21726\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 83\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 83, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/wp-admin\/network\/ms-plugins%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/wp-admin\/network\/ms-plugins%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gz\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_wp_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_wp_scan\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950503:cms-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_wp_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_wp_scan\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":397},{"id":12579710,"ip":"51.118.97.142","ts":"2026-07-16 21:54:01.000000","proto":"tcp","src_port":61830,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/decode%2ephp%2eold","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u00229176492dea225c37afe64355a4573bac33b15403\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 382, \u0022payload_entropy\u0022: 5.155354187100847, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00221d525326a50f2225cadb028f9cec920f20c27085\u0022, \u0022event_fingerprint\u0022: \u0022d0c7841ea4767fbeed935f6c390fa15f6cbab079\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022e5320ced84c9e10e0c04e4b4514332d1\u0022, \u0022path_pattern_hash\u0022: \u002232feccaba1604e74f0afb6a05e1e09fe\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/decode%2ephp%2eold\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/decode%2ephp%2eold\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTru\u0022, \u0022payload_snippet\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223d53710a89d222b38fb84267bbfa0ac6ece454e2\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/decode%2ephp%2eold\u0022, \u0022request_line\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/decode%2ephp%2eold\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/decode%2ephp%2eold\u0022, \u0022request_line\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/decode%2ephp%2eold\u0022, \u0022evidence_snippet\u0022: \u0022GET \/decode%2ephp%2eold HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lang\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":382},{"id":12579711,"ip":"51.118.97.142","ts":"2026-07-16 21:54:01.000000","proto":"tcp","src_port":61838,"dst_port":8028,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/admin\/tmp\/settings%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u00228570f8553126c3d30f053cbaf09c38af8a38a09a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 389, \u0022payload_entropy\u0022: 5.179748120133523, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 83, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e5e7b1725bd0f6d18118942ac2ccd9ce5bbd1dc4\u0022, \u0022event_fingerprint\u0022: \u002277cf4ad6dc7543717fd3ad2720a958131f1d462d\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ET Magento admin\u0022, \u0022ES admin GET\u0022, \u0022ActiveMQ console\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00224d4a7b548670c3f15d766a7c96916adc\u0022, \u0022path_pattern_hash\u0022: \u0022018008c41ceedeb260bc2b30df63430d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 83}, \u0022payload_preview\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/tmp\/settings%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/tmp\/settings%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022363005a22764f72e8d845a4565a0191b97c7a57e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/tmp\/settings%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/tmp\/settings%2ejson\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 83\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 83, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/tmp\/settings%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/tmp\/settings%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/admin\/tmp\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcce\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":389},{"id":12579712,"ip":"51.118.97.142","ts":"2026-07-16 21:54:01.000000","proto":"tcp","src_port":61848,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api-key_cloudfront%2etxt","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022b780fe5356382fdf7dadb1e9cfa6adc3341b7fad\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.192470747412736, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00227da924cb34c05f05d32708e1f914f63452b70e1c\u0022, \u0022event_fingerprint\u0022: \u0022d959fae1be4970014650cb425fbe161e1bf33ff8\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00220041f970822b3e62fb054b4a92adba25\u0022, \u0022path_pattern_hash\u0022: \u0022c8c4be3a6a7f473bb92f01164b059b48\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key_cloudfront%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key_cloudfront%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228577e78758510bd532ddc8c72d85424020966ea1\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key_cloudfront%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key_cloudfront%2etxt\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key_cloudfront%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key_cloudfront%2etxt\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api-key_cloudfront%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12579684,"ip":"51.118.97.142","ts":"2026-07-16 21:54:00.000000","proto":"tcp","src_port":15108,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/slack_api_key%2etxt","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u00224f67881f111a3db188813e19a5fedf72fc20a61a\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 383, \u0022payload_entropy\u0022: 5.194465668623944, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00227da924cb34c05f05d32708e1f914f63452b70e1c\u0022, \u0022event_fingerprint\u0022: \u0022a479ec459ee6a51ad8e7f3b47520d8d90a8ca113\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022607dace1ab9f39605df5939aa6a9f5ff\u0022, \u0022path_pattern_hash\u0022: \u0022997b6c777514621d5fc0db4f7df9b95e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/slack_api_key%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/slack_api_key%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222273e2118fe084d43e9852e6c50cb0a9836a0ce2\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/slack_api_key%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/slack_api_key%2etxt\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/slack_api_key%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/slack_api_key%2etxt\u0022, \u0022evidence_snippet\u0022: \u0022GET \/slack_api_key%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":383},{"id":12579685,"ip":"51.118.97.142","ts":"2026-07-16 21:54:00.000000","proto":"tcp","src_port":15122,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/core\/sql\/settings%2ejson","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022f713e687d10b1ef89cde41580dd4b64d36c1112d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.163133952754152, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00227ac70ef4b8bacedbb9d66d9de0d63b671b3420de\u0022, \u0022event_fingerprint\u0022: \u0022284e981a193b13096b6fdc34ad408ab5bc4bbd53\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022aab08f080edc192217fea684093bff6f\u0022, \u0022path_pattern_hash\u0022: \u0022f695599c426f3fa01dfc982b4508daaa\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/sql\/settings%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/core\/sql\/settings%2ejson\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022eb851293d003931761319674eb662791870bec6a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/sql\/settings%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/sql\/settings%2ejson\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/core\/sql\/settings%2ejson\u0022, \u0022request_line\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/core\/sql\/settings%2ejson\u0022, \u0022evidence_snippet\u0022: \u0022GET \/core\/sql\/settings%2ejson HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_core\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12579686,"ip":"51.118.97.142","ts":"2026-07-16 21:54:00.000000","proto":"tcp","src_port":15142,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/mailgun\/sendgrid_api_key%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u00222be079332c04ba6dfd68b21873fe837316b2d866\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 401, \u0022payload_entropy\u0022: 5.223959213535668, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 17, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022f604cf5995c86d6725a102951b77300246efceb0\u0022, \u0022event_fingerprint\u0022: \u0022521593906457d9182ba65cf8502c1fdbbb658f76\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00228730c10868e1acb6fa178ff3d1c28133\u0022, \u0022path_pattern_hash\u0022: \u0022d1f7a6c60f176de79efd6cf86e101bb6\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f21188b9ed0c395a5b6893e2fc389b309a4ef9fd\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/mailgun\/sendgrid_api_key%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/mailgun\/sendgrid_api_key%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":401},{"id":12579687,"ip":"51.118.97.142","ts":"2026-07-16 21:54:00.000000","proto":"tcp","src_port":15144,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/secrets\/settings%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u002294a893c5793b7963caf14b2735bdb6517354bc00\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 390, \u0022payload_entropy\u0022: 5.150576335401256, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022c921901dfe45aa8a52cce7dd420c7071b9e5ec06\u0022, \u0022event_fingerprint\u0022: \u0022f204cb865ab6c491072cc7262e1e41e18a2d430c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022c91ac9d542a14f9c3ce047e91ae9a5be\u0022, \u0022path_pattern_hash\u0022: \u00227f8aef03e9383566f2641607540d417b\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/secrets\/settings%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/secrets\/settings%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227889998f19cb7e9193a9abad27c451a8f5d63f63\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/secrets\/settings%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/secrets\/settings%2eenv\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/secrets\/settings%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/secrets\/settings%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/secrets\/settings%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAcc\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_k8s_probe\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":390},{"id":12579688,"ip":"51.118.97.142","ts":"2026-07-16 21:54:00.000000","proto":"tcp","src_port":15150,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/armnn\/env%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u00223018cb95243bc16776e28bb51ebdab0add14eda7\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 379, \u0022payload_entropy\u0022: 5.15466857761048, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00220c7fe37adc33c6996f2911ab8a12ff26eb10eef0\u0022, \u0022event_fingerprint\u0022: \u002298f025a666a967a408f60312e7d06f509202502b\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002236703f08d0072876b7443eb059b36381\u0022, \u0022path_pattern_hash\u0022: \u0022dd5aea81f1e2902d0553a9e84ef93dc3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/armnn\/env%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/armnn\/env%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-C\u0022, \u0022payload_snippet\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002236f1e08c9ddfc89e905ddc80b89fdfdfc8315e27\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/armnn\/env%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/armnn\/env%2eenv\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/armnn\/env%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/armnn\/env%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/armnn\/env%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Languag\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":379},{"id":12579689,"ip":"51.118.97.142","ts":"2026-07-16 21:54:00.000000","proto":"tcp","src_port":15160,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/config\/sample%2ebak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u002250aaaa9aa133d35fa3aa95c51c475620f1e9001c\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 383, \u0022payload_entropy\u0022: 5.188028024403875, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022381f510dbcac969e0932f192d3c8788065601780\u0022, \u0022event_fingerprint\u0022: \u00227b2a94cd175f9d320f0ed64db44c069e24d6c236\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002225e8888a9b63ab4f2064d31a74e990ea\u0022, \u0022path_pattern_hash\u0022: \u00228d06070e9c9922e376f5a87aad4d0fab\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sample%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/config\/sample%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTr\u0022, \u0022payload_snippet\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221e3ac9f4e72508475454bfa44c447fa3e7b2d87a\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sample%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sample%2ebak\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/config\/sample%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/config\/sample%2ebak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/config\/sample%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Lan\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_config\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":383},{"id":12579690,"ip":"51.118.97.142","ts":"2026-07-16 21:54:00.000000","proto":"tcp","src_port":15166,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022f0d8eecf3e972fd0e3f7a8fce92e2d8d58bd987f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 409, \u0022payload_entropy\u0022: 5.267260843884132, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00220c7fe37adc33c6996f2911ab8a12ff26eb10eef0\u0022, \u0022event_fingerprint\u0022: \u002223c429227f088b5501459fb36c2ff21362b79569\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002252f879c900800562af24b27d9418f355\u0022, \u0022path_pattern_hash\u0022: \u0022570e00ca8fa297c6c2ecbda5b086280c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002212cf33bab4083bf78b7523b8d82038a874a07c73\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022request_line\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2ejenkins\/hudson%2etasks%2eWebAssembly%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":409},{"id":12579691,"ip":"51.118.97.142","ts":"2026-07-16 21:54:00.000000","proto":"tcp","src_port":15170,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/settings%2epy%2eorig","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022e8aa58d373021c43cb2633d417ebd462bc4d5a6d\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 384, \u0022payload_entropy\u0022: 5.153639333897606, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00227da924cb34c05f05d32708e1f914f63452b70e1c\u0022, \u0022event_fingerprint\u0022: \u002263795de3bb9b98ccc2733359099986e4140f732c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00225298e4c013dd63a1ec7e9d421171fe3b\u0022, \u0022path_pattern_hash\u0022: \u002211582cbdb6718d89141ec3d325abff39\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/settings%2epy%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/settings%2epy%2eorig\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b580fd827efd356301861935ba779960eaf63144\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/settings%2epy%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/settings%2epy%2eorig\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/settings%2epy%2eorig\u0022, \u0022request_line\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/settings%2epy%2eorig\u0022, \u0022evidence_snippet\u0022: \u0022GET \/settings%2epy%2eorig HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":384},{"id":12579692,"ip":"51.118.97.142","ts":"2026-07-16 21:54:00.000000","proto":"tcp","src_port":15174,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":33,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api\/public\/config%2exml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u00220384df45554daec98d08f86ba73f2432f210c731\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 387, \u0022payload_entropy\u0022: 5.199640595853105, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00226a890489699df34a80921840d4a95a46b992514d\u0022, \u0022event_fingerprint\u0022: \u00229e741eeedf9aa25e01f7ee6d165010afdb6716c9\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002261bd0e37aa562a1e560a6f77351bef43\u0022, \u0022path_pattern_hash\u0022: \u0022c66eae166966f1c8bc6680c13b79086c\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/public\/config%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/public\/config%2exml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e31f7613166f875bbae0030a51c1237245029d12\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/public\/config%2exml\u0022, \u0022request_line\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/public\/config%2exml\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/public\/config%2exml\u0022, \u0022request_line\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api\/public\/config%2exml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/public\/config%2exml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_api\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":387},{"id":12579693,"ip":"51.118.97.142","ts":"2026-07-16 21:54:00.000000","proto":"tcp","src_port":15184,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/info4%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u00225b799c4b6ebcc4b3a9438741142d022a47b5d659\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 375, \u0022payload_entropy\u0022: 5.170816916213061, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00227da924cb34c05f05d32708e1f914f63452b70e1c\u0022, \u0022event_fingerprint\u0022: \u00222afaa4bb0270f9c6ded78735e56be51637e1bf46\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022fd3ada15c13724e76c0b3de877c34568\u0022, \u0022path_pattern_hash\u0022: \u0022aa6001943d9690d57e8a283353e2a677\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info4%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info4%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Clien\u0022, \u0022payload_snippet\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cf6849dccc565d588726d4096af4804ffc189bbd\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info4%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/info4%2ephp\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info4%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/info4%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/info4%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: e\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":375},{"id":12579694,"ip":"51.118.97.142","ts":"2026-07-16 21:54:00.000000","proto":"tcp","src_port":15192,"dst_port":8028,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/admin\/test\/main%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u00222683a0217401eb0e58d5fe7eec10204f0e06c3a8\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 385, \u0022payload_entropy\u0022: 5.167874246358988, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 83, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e5e7b1725bd0f6d18118942ac2ccd9ce5bbd1dc4\u0022, \u0022event_fingerprint\u0022: \u002213496c877cad28c4b4f3be33f459398f40bb21f7\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ET Magento admin\u0022, \u0022ES admin GET\u0022, \u0022ActiveMQ console\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00226f2158f6a03d0d460cf222f31d948710\u0022, \u0022path_pattern_hash\u0022: \u002211679f661efb536d80c1931b06526b9d\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 83}, \u0022payload_preview\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/test\/main%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/test\/main%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222277da6ae620a27536030b340c0f0a3e1cc7eed7\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/test\/main%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/test\/main%2eenv\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 83\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 83, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/test\/main%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/test\/main%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/admin\/test\/main%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":385},{"id":12579695,"ip":"51.118.97.142","ts":"2026-07-16 21:54:00.000000","proto":"tcp","src_port":15206,"dst_port":8028,"service":"http","classification":"config_file_probe","waf_score":31,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/%2eenv%2eexample-hotfix","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022743fece80801d4ea4cab1adf80ab535faee6f034\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 387, \u0022payload_entropy\u0022: 5.198776874660665, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 83, \u0022tag_count\u0022: 18, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022f317fcdfd4e80a57b2c9a2a15fe18cabb648c761\u0022, \u0022event_fingerprint\u0022: \u0022a81d6e88542ee003a1f5b4ba48f3f89e37290688\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00223026219621f65e0c2b18afa3d89647a0\u0022, \u0022path_pattern_hash\u0022: \u0022e4a000b7b4be6ad319c134450cae8196\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 83}, \u0022payload_preview\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2eenv%2eexample-hotfix\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/%2eenv%2eexample-hotfix\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\u0022, \u0022payload_snippet\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002263652860684db11336152834161426402f32153e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2eenv%2eexample-hotfix\u0022, \u0022request_line\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2eenv%2eexample-hotfix\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 83\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 83, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/%2eenv%2eexample-hotfix\u0022, \u0022request_line\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/%2eenv%2eexample-hotfix\u0022, \u0022evidence_snippet\u0022: \u0022GET \/%2eenv%2eexample-hotfix HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":387},{"id":12579696,"ip":"51.118.97.142","ts":"2026-07-16 21:54:00.000000","proto":"tcp","src_port":61716,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/app\/elasticemail%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u00223ef7c947081c1beb4061bca77ba7b50faefd2e06\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 386, \u0022payload_entropy\u0022: 5.165555691972388, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00220c7fe37adc33c6996f2911ab8a12ff26eb10eef0\u0022, \u0022event_fingerprint\u0022: \u002278633becd10b44b8aecbcd89afaeaad7ad45086d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002289cdffeab684b639b8d58211d8fd6907\u0022, \u0022path_pattern_hash\u0022: \u0022360aadd960970cd36ff7d3e483dc7910\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/app\/elasticemail%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/app\/elasticemail%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022daa10a886437346a7c2b608eba49199981f36857\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/app\/elasticemail%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/app\/elasticemail%2eenv\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/app\/elasticemail%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/app\/elasticemail%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/app\/elasticemail%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":386},{"id":12579697,"ip":"51.118.97.142","ts":"2026-07-16 21:54:00.000000","proto":"tcp","src_port":61724,"dst_port":8028,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/portal\/%2eenv%2eprod","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022093ebda3dedfdb4a0cf459c6463c195139c940a9\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 384, \u0022payload_entropy\u0022: 5.156923943293474, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 83, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00221ce5f30650a22e45a69fbd80c13308e3798ade41\u0022, \u0022event_fingerprint\u0022: \u00223f3390441f627bf1e9699a4335cc9257383f8a92\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022dbacdea863b052e75785bb550fdf9ea2\u0022, \u0022path_pattern_hash\u0022: \u0022cdaa04f21ead530e229f84bd2ffd4513\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 83}, \u0022payload_preview\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/portal\/%2eenv%2eprod\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/portal\/%2eenv%2eprod\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nT\u0022, \u0022payload_snippet\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c534ec38b8e90d7b52610aa7182f2b2dd472684f\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/portal\/%2eenv%2eprod\u0022, \u0022request_line\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/portal\/%2eenv%2eprod\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 83\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 83, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/portal\/%2eenv%2eprod\u0022, \u0022request_line\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/portal\/%2eenv%2eprod\u0022, \u0022evidence_snippet\u0022: \u0022GET \/portal\/%2eenv%2eprod HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-La\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":384},{"id":12579671,"ip":"51.118.97.142","ts":"2026-07-16 21:53:59.000000","proto":"tcp","src_port":14978,"dst_port":8028,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/news-app\/frontend\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022a1ee74ed4f5cbbbb2314d7946ff753422c481b9e\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 388, \u0022payload_entropy\u0022: 5.1645574529535185, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 83, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00221ce5f30650a22e45a69fbd80c13308e3798ade41\u0022, \u0022event_fingerprint\u0022: \u00223c074e0a19d2ecd8737c544247669a250d2cd6cb\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00224d0f616486d4294cdecdd863948db74f\u0022, \u0022path_pattern_hash\u0022: \u0022c6504031f3d04dadfc28bcbaf3b80654\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 83}, \u0022payload_preview\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/news-app\/frontend\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/news-app\/frontend\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.\u0022, \u0022payload_snippet\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223ebf1c9fd4244ccca6995e59d3d1c66e2750a25e\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/news-app\/frontend\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/news-app\/frontend\/%2eenv\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 83\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 83, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/news-app\/frontend\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/news-app\/frontend\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/news-app\/frontend\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccep\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":388},{"id":12579672,"ip":"51.118.97.142","ts":"2026-07-16 21:53:59.000000","proto":"tcp","src_port":14994,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":23,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/api-key_rds%2etxt","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022b9c35411a868e13698ae043c8800ad598064f4fc\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 381, \u0022payload_entropy\u0022: 5.1778426600932415, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 15, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00227da924cb34c05f05d32708e1f914f63452b70e1c\u0022, \u0022event_fingerprint\u0022: \u00223ff2bbff68ccee2ba95abece534ab0925870c59a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002203b1279cb4be6a832996d5f74831584b\u0022, \u0022path_pattern_hash\u0022: \u0022ef70829daa0d0fccdd9054af46ca9c1f\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/api-key_rds%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key_rds%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key_rds%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key_rds%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key_rds%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api-key_rds%2etxt\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/api-key_rds%2etxt HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api-key_rds%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue\u0022, \u0022payload_snippet\u0022: \u0022GET \/api-key_rds%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b47fd11fb1b1952001b1b325d500d88077e93070\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key_rds%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/api-key_rds%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api-key_rds%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key_rds%2etxt\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api-key_rds%2etxt\u0022, \u0022request_line\u0022: \u0022GET \/api-key_rds%2etxt HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/api-key_rds%2etxt\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api-key_rds%2etxt HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langu\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":381},{"id":12579673,"ip":"51.118.97.142","ts":"2026-07-16 21:53:59.000000","proto":"tcp","src_port":15012,"dst_port":8028,"service":"http","classification":"config_file_probe","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/admin\/config\/settings%2eyml","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022e0cd3da1e9ceb9495dca5d8a9936d6b995ebf201\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 391, \u0022payload_entropy\u0022: 5.191240950183853, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 83, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022e5e7b1725bd0f6d18118942ac2ccd9ce5bbd1dc4\u0022, \u0022event_fingerprint\u0022: \u00228b3bc9ce1428e12c4ebad1f791fd46921253a5de\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022, \u0022ET Magento admin\u0022, \u0022ES admin GET\u0022, \u0022ActiveMQ console\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022, \u0022pat-0854\u0022, \u0022pat-0341\u0022, \u0022pat-0606\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00220e163ae7352717415ca5fdc1a2ad8eea\u0022, \u0022path_pattern_hash\u0022: \u002237329233134a81eb31a2e80267f34085\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 83}, \u0022payload_preview\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/config\/settings%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/admin\/config\/settings%2eyml\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0\u0022, \u0022payload_snippet\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228ff7029ec26da0aeec3a4f8567abc21ba20496a7\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/config\/settings%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/config\/settings%2eyml\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 83\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 83, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/admin\/config\/settings%2eyml\u0022, \u0022request_line\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/admin\/config\/settings%2eyml\u0022, \u0022evidence_snippet\u0022: \u0022GET \/admin\/config\/settings%2eyml HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAc\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_admin_panel_probe\u0022, \u0022http_admin_panel_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_admin\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":391},{"id":12579674,"ip":"51.118.97.142","ts":"2026-07-16 21:53:59.000000","proto":"tcp","src_port":15024,"dst_port":8028,"service":"http","classification":"config_file_probe","waf_score":45,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/bot\/%2eenv%2ebak","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022436590482694e8e3a458ea0154cc9f648da77b7e\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 380, \u0022payload_entropy\u0022: 5.17310307543681, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 83, \u0022tag_count\u0022: 22, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u002217381c5e05f4bb03da2f579d38cc4970368b8ae4\u0022, \u0022event_fingerprint\u0022: \u0022bebe2bb3f693337f4ac85525652140a9e73e4b5c\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022f38862aea46f8f88fccfc1c4e5885491\u0022, \u0022path_pattern_hash\u0022: \u0022846f757714e155dd7260c351bd4e596e\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 83}, \u0022payload_preview\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/bot\/%2eenv%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-\u0022, \u0022payload_snippet\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/bot\/%2eenv%2ebak\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022leak-8\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-\u0022, \u0022payload_snippet\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022febe927336c89c280d8ff99a188bfe866f4a7211\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/bot\/%2eenv%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/bot\/%2eenv%2ebak\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 7 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 83\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 83, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/bot\/%2eenv%2ebak\u0022, \u0022request_line\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/bot\/%2eenv%2ebak\u0022, \u0022evidence_snippet\u0022: \u0022GET \/bot\/%2eenv%2ebak HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Langua\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 7 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022botnet_http_c2\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022950521:leak-8\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022botnet_http_c2\u0022, \u0022http_backup_file_scan\u0022, \u0022http_backup_path\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":380},{"id":12579675,"ip":"51.118.97.142","ts":"2026-07-16 21:53:59.000000","proto":"tcp","src_port":15030,"dst_port":8028,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/master\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022a57464b29ecbac66ddd4b4e36d7a9af73b3c29d2\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 377, \u0022payload_entropy\u0022: 5.15379950550082, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 83, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00221ce5f30650a22e45a69fbd80c13308e3798ade41\u0022, \u0022event_fingerprint\u0022: \u002262d19fbcb3c35f1aa750e552942ef6789542fb9f\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u0022b6612a3b16425c9f03ef85a8f63292f3\u0022, \u0022path_pattern_hash\u0022: \u00224cc262daae84eae4ecf616019075e632\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 83}, \u0022payload_preview\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/master\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/master\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002271c89e062e496a76a607d7bd62b3e79136b93e07\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/master\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/master\/%2eenv\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 83\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 83, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/master\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/master\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/master\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":377},{"id":12579676,"ip":"51.118.97.142","ts":"2026-07-16 21:53:59.000000","proto":"tcp","src_port":15034,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/src\/main\/resources\/harness%2eproperties","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 4, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u00224a7c51fbeb33f889cf65afd1aef7fc451fd88c69\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 403, \u0022payload_entropy\u0022: 5.16866269736307, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00220c7fe37adc33c6996f2911ab8a12ff26eb10eef0\u0022, \u0022event_fingerprint\u0022: \u00227e378cc598a91911594ef07c514061b2503cd038\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022CRS 941150\u0022, \u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0286\u0022, \u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u002210f32297ebc0e2c52b5e8919360bbdf5\u0022, \u0022path_pattern_hash\u0022: \u00227ce39adf2c85187b760d41b6bdc4487a\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/src\/main\/resources\/harness%2eproperties\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/src\/main\/resources\/harness%2eproperties\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Clie\u0022, \u0022payload_snippet\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002207a203e40a75681849881f2e65e7a8a07a3de7f4\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/src\/main\/resources\/harness%2eproperties\u0022, \u0022request_line\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/src\/main\/resources\/harness%2eproperties\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/src\/main\/resources\/harness%2eproperties\u0022, \u0022request_line\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/src\/main\/resources\/harness%2eproperties\u0022, \u0022evidence_snippet\u0022: \u0022GET \/src\/main\/resources\/harness%2eproperties HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encodi\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":403},{"id":12579677,"ip":"51.118.97.142","ts":"2026-07-16 21:53:59.000000","proto":"tcp","src_port":15042,"dst_port":8028,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/live\/%2eenv%2estaging","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022eef3d069f0cc60d79bbb0686c812fac8298771e0\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 385, \u0022payload_entropy\u0022: 5.158546293898628, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 78, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00222208a686e1315b61d1c95638902d20f73ddee87e\u0022, \u0022event_fingerprint\u0022: \u0022368bf769068b9d354dc0c5d0aecf59ff7d389081\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.5, \u0022classification_confidence\u0022: 0.5, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00227df8dcea47007afde0e60148445666fa\u0022, \u0022path_pattern_hash\u0022: \u0022c48c1b047d9c9ede8ca027bd7afa77df\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 78}, \u0022payload_preview\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/live\/%2eenv%2estaging\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/live\/%2eenv%2estaging\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre\u0022: \u0022TA0001\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cd3bc44f1a1f9206addae6a8c69b9238f3c75685\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/live\/%2eenv%2estaging\u0022, \u0022request_line\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/live\/%2eenv%2estaging\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 50, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 78}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 78, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0001\u0022, \u0022mitre_technique\u0022: \u0022TA0001\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Confiance mod\u00e9r\u00e9e \u2014 signal unique\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/live\/%2eenv%2estaging\u0022, \u0022request_line\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/live\/%2eenv%2estaging\u0022, \u0022evidence_snippet\u0022: \u0022GET \/live\/%2eenv%2estaging HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 50 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_live\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_probe_live\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":385},{"id":12579678,"ip":"51.118.97.142","ts":"2026-07-16 21:53:59.000000","proto":"tcp","src_port":15044,"dst_port":8028,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/payment-app\/api\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u00225a2b53ab33b90300214cb62365a512ab49f441a6\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 386, \u0022payload_entropy\u0022: 5.1739988739617795, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 83, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00221ce5f30650a22e45a69fbd80c13308e3798ade41\u0022, \u0022event_fingerprint\u0022: \u0022418f8c97ccca199c554ebdb2929a0d24bfb8b3ca\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00220fa368fc120af005fe9adf4647452cbe\u0022, \u0022path_pattern_hash\u0022: \u00225dd6ccc5ca99af94dc94d2ea0f2b77a5\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 83}, \u0022payload_preview\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/payment-app\/api\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/payment-app\/api\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\u0022, \u0022payload_snippet\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225f5cbf6741786c417781a1d9f0471beb1c6b00ec\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/payment-app\/api\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/payment-app\/api\/%2eenv\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 83\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 83, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/payment-app\/api\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/payment-app\/api\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/payment-app\/api\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":386},{"id":12579679,"ip":"51.118.97.142","ts":"2026-07-16 21:53:59.000000","proto":"tcp","src_port":15054,"dst_port":8028,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/custom\/%2eenv","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u002283345ee7b16d1d2aa90988b373c2a7cb2bbaed12\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 377, \u0022payload_entropy\u0022: 5.159022342696967, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 83, \u0022tag_count\u0022: 19, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00221ce5f30650a22e45a69fbd80c13308e3798ade41\u0022, \u0022event_fingerprint\u0022: \u00220cdd9c2d2d74edd4fee46d1cb0029a235592e64d\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00228939c8cb3b8c4b738394a114d1557ca7\u0022, \u0022path_pattern_hash\u0022: \u00224e59106525e243287c9376964c3f2170\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 83}, \u0022payload_preview\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/custom\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/custom\/%2eenv\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-1\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cli\u0022, \u0022payload_snippet\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f3642e999a1cc89034b92cce817c76daf1f965bb\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/custom\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/custom\/%2eenv\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 83\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 83, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/custom\/%2eenv\u0022, \u0022request_line\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/custom\/%2eenv\u0022, \u0022evidence_snippet\u0022: \u0022GET \/custom\/%2eenv HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language:\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950514:leak-1\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":377},{"id":12579680,"ip":"51.118.97.142","ts":"2026-07-16 21:53:59.000000","proto":"tcp","src_port":15060,"dst_port":8028,"service":"http","classification":"http_flood","waf_score":29,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/new\/info%2ephp","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 2, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u00223be98612c14adf93fb1cfe89830f0d980f09dbab\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 378, \u0022payload_entropy\u0022: 5.163691275054626, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 84, \u0022tag_count\u0022: 16, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u00220c7fe37adc33c6996f2911ab8a12ff26eb10eef0\u0022, \u0022event_fingerprint\u0022: \u002226783e450baaf98bfff118104d4c8c28be9a4cb0\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 122, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00227d13f6d5e20decd11945b17b010860c9\u0022, \u0022path_pattern_hash\u0022: \u0022a7a9f5c2684b775940252b03aea345bb\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 84}, \u0022payload_preview\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/new\/info%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/new\/info%2ephp\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\nTrue-Cl\u0022, \u0022payload_snippet\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a876c72fdb3e6d4bcbe98e00f24bd7e44f3ce7d0\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/new\/info%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/new\/info%2ephp\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 84\/100 (\u00c9lev\u00e9) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 84}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 84, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/new\/info%2ephp\u0022, \u0022request_line\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/new\/info%2ephp\u0022, \u0022evidence_snippet\u0022: \u0022GET \/new\/info%2ephp HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":378},{"id":12579681,"ip":"51.118.97.142","ts":"2026-07-16 21:53:59.000000","proto":"tcp","src_port":15072,"dst_port":8028,"service":"http","classification":"config_file_probe","waf_score":37,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022]","http_method":"GET","http_target":"\/publics\/%2egit\/config","sensor_id":"paris-1","meta":"{\u0022http_header_count\u0022: 14, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002219d98cb8097a82cf332d2745e2b79cadcebba03e\u0022, \u0022http_host_hash\u0022: \u0022d2a38f69fe47282473d08ed82cbe719dc399439f\u0022, \u0022http_target_hash\u0022: \u0022dffdd03c5a3f6000d7374bbeda953224c20b9853\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: true, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 385, \u0022payload_entropy\u0022: 5.173075125667586, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 16509, \u0022country\u0022: \u0022IT\u0022, \u0022dst_port\u0022: 8028, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 74.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 40.0, \u0022risk_protocol\u0022: 35.0, \u0022risk_novelty\u0022: 30.0, \u0022risk_boost\u0022: 12, \u0022risk_granularity\u0022: 7.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0}, \u0022risk_score\u0022: 83, \u0022tag_count\u0022: 20, \u0022anomaly_count\u0022: 1, \u0022campaign_key\u0022: \u0022f57311955a44f8442e3dc97c2aa4d285cf7334bd\u0022, \u0022event_fingerprint\u0022: \u002214324f56d925a2b7e964a466961e19f1bd137d03\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 127, \u0022precision_signals\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022matched_patterns\u0022: [\u0022pat-0340\u0022], \u0022matched_pattern_names\u0022: [\u0022SSRF Localhost SSRF\u0022], \u0022pattern_ids\u0022: [\u0022pat-0340\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022named_classification_skipped\u0022: false, \u0022classification_parent\u0022: \u0022backup_file_scan\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022IT\u0022, \u0022asn\u0022: 16509, \u0022org\u0022: \u0022Amazon.com, Inc.\u0022, \u0022is_datacenter\u0022: true, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00228f42af6f304383bbe22bc11b9f1c9ce7\u0022, \u0022payload_hash\u0022: \u00220c09812528b7de1517e383ecb88a0d24\u0022, \u0022path_pattern_hash\u0022: \u0022c022a7a77ca5d3c8e53e008c45692091\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 83}, \u0022payload_preview\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/publics\/%2egit\/config\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-0\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/publics\/%2egit\/config\u0022, \u0022user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022ssrf-2\u0022, \u0022nosqli-3\u0022, \u0022leak-0\u0022, \u0022dns-rebind\u0022, \u0022scanner-ua\u0022], \u0022request_line\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.9\\r\\nX-Forwarded-For: 127.0.0.1\\r\\nX-Real-IP: 127.0.0.1\\r\\nX-Originating-IP: 127.0.0.1\\r\\nX-Client-IP: 127.0.0.1\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1083\u0022], \u0022mitre\u0022: \u0022T1083\u0022, \u0022threat_family\u0022: [\u0022path_traversal\u0022, \u0022config_leak_scan\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225cde92d05b005339b5373e4130511a3c17b299df\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/publics\/%2egit\/config\u0022, \u0022request_line\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/publics\/%2egit\/config\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 83\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 74.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 40.0, \u0022protocol\u0022: 35.0, \u0022novelty\u0022: 30.0, \u0022risk_score\u0022: 83}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 83, \u0022risk_label\u0022: \u0022\u00c9lev\u00e9\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8028, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022INT-http_sensitive\u0022, \u0022INT-upstream\u0022, \u0022INT-waf-score\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Http Sensitive\u0022, \u0022Upstream\u0022, \u0022Waf Score\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1083\u0022, \u0022mitre_technique\u0022: \u0022T1083\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/publics\/%2egit\/config\u0022, \u0022request_line\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022curl\/8.7.1\u0022, \u0022port\u0022: 8028, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022config file probe \u00b7 via HTTP:8028 \u00b7 (tentative d\u0027exploit) \u00b7 \u2192 \/publics\/%2egit\/config\u0022, \u0022evidence_snippet\u0022: \u0022GET \/publics\/%2egit\/config HTTP\/1.1\\r\\nHost: 62.3.50.33:8028\\r\\nUser-Agent: curl\/8.7.1\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip\\r\\nAccept-L\u0022, \u0022target_port_label\u0022: \u00228028 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 6 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228028\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_git_exposure\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022], \u0022asn_dc_heuristic\u0022: true}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8028","http_user_agent":"curl\/8.7.1","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950402:ssrf-2\u0022, \u0022950468:nosqli-3\u0022, \u0022950513:leak-0\u0022, \u0022951041:dns-rebind\u0022, \u0022anomaly:scanner-ua\u0022, \u0022http_backup_file_scan\u0022, \u0022http_cache_poison_header\u0022, \u0022http_cache_poison_host\u0022, \u0022http_dns_rebinding\u0022, \u0022http_git_exposure\u0022, \u0022http_header_x-client-ip\u0022, \u0022http_header_x-forwarded-for\u0022, \u0022http_header_x-host\u0022, \u0022http_header_x-real-ip\u0022, \u0022http_host_header_injection\u0022, \u0022http_sensitive_path\u0022, \u0022http_ua_suspicious\u0022, \u0022http_xff_loopback\u0022, \u0022scanner-ua\u0022]","anomalies":"[\u0022scanner-ua\u0022]","severity":10,"bytes_in":385}],"total_events":3000}