Renseignement sur les menaces

France

51.159.125.208

FAI Scaleway SAS Première vue 14/07/2026 17:11 UTC Dernière vue 14/07/2026 17:11 UTC Risque Élevé

Période analysée : 2026-04-23 → 2026-07-22

Activité suspecte — risque 54/100 (Moyen) — MITRE TA0001 — confiance 58 % — via HTTP — multi-protocole (2 protocoles · 5 min)

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Élevé · Risque max (7j) Élevé

Synthèse exécutive

Profil de menace

Score de risque 66/100 Élevé

Première observation 14/07/2026 17:11 UTC

Dernière observation 14/07/2026 17:11 UTC

Événements (période) 18

MITRE ATT&CK principal TA0007 7 occurrences

Activité suspecte — risque 54/100 (Moyen) — MITRE TA0001 — confiance 58 % — via HTTP — multi-protocole (2 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Règle WAF « ssrf-3 » · confiance 50%

Confiance 58 % — Score WAF 84 · Bonus corrélation +8 · 3 tag(s) WAF

Comparaison ASN / FAI

ASN 12876 · 51.158.0.0/15 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 18 événements sur la période pour cette IP.

51.159.110.167 minecraft probe 22/07/2026 20:38 UTC
51.15.115.141 Sonde PostgreSQL 22/07/2026 12:48 UTC
51.15.44.6 Sonde HTTP 22/07/2026 12:48 UTC
62.210.142.179 Sonde HTTP 22/07/2026 09:39 UTC
62.210.90.214 Sonde port 1911/TCP 22/07/2026 08:09 UTC
51.159.3.132 upnp-tcp 21/07/2026 16:07 UTC
51.158.248.210 Scan vulnérabilités 21/07/2026 07:39 UTC
151.115.48.199 minecraft probe 21/07/2026 05:19 UTC

Événements (filtres)

Première observation

14/07/2026 17:11 UTC

Dernière observation

14/07/2026 17:11 UTC

Dernière activité (filtres)

14/07/2026 17:11 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

—

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 16 HTTP ALT 8085 TCP 2

HTTP

HTTP ALT 8085

Géolocalisation

Origine réseau déclarée

France unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Scaleway SAS 0 Port 8085 postgres_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

ssrf attack · via HTTP:8085 · (tentative d'exploit) · → /favicon.ico

Détails protocole

Méthode: GET
Chemin: /favicon.ico
User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler)

Aperçu payload

GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.co

Port / service

8085 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 50 % — 3 tag(s) WAF

Technique MITRE

TA0001

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

Upstream Waf Score

Confiance

58% Corrélation +8

Famille de menace

ssrf_probe

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

18 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

18 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
14/07/2026 17:11:47 UTC	TCP	8085 · HTTP	http	SSRF ssrf attack · via HTTP:8085 · (tentative d'exploit) · → /favicon.ico	Élevée	Moyen · 54
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /favicon.ico UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 net_web_probe Cible HTTP GET /favicon.ico TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible /favicon.ico Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 54 Confiance : Confiance 50 % — 3 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /favicon.ico HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.co Requête brute (extrait) GET /favicon.ico HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600", "emulator_response_len": 130, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "ico", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 184, "payload_entropy": 5.221864129861555, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 84, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 54, "tag_count": 4, "anomaly_count": 0, "campaign_key": "afb30822fb050a2caf5c8c4a01c1c06dcb46acbb", "event_fingerprint": "8bc3e3a8d58f8445500ffbf08597c5f42efa3638", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 54, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "ef5fe3cde6e062e5c748ac2dbe7a9deb", "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 54 }, "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "evidence": { "method": "GET", "path": "\/favicon.ico", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/favicon.ico HTTP\/1.1", "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "270a2101054c79d5883480ec995d99da360e3d29", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "attack_vector": "ssrf attack \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 54, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 54, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/favicon.ico", "request_line": "GET \/favicon.ico HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico", "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.co", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8085" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "net_web_probe" ] }
14/07/2026 17:11:46 UTC	TCP	8085 · HTTP	http	jenkins probe jenkins probe · via HTTP:8085 · (sonde / probe) · → /manage/account/login	Élevée	Moyen · 55
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /manage/account/login UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /manage/account/login TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible /manage/account/login Service HTTP Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47% Confiance classification 55% Corrélation +8 Risque capteur Moyen · 55 Confiance : Confiance 47 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux Cicd Jenkins Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /manage/account/login HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /manage/account/login HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www Requête brute (extrait) GET /manage/account/login HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 3, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "1d98e547275d79a259c88ab2179d7a5b45136091", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 193, "payload_entropy": 5.179179421631153, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 100, "risk_classification": 60, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.1, "risk_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 55, "tag_count": 6, "anomaly_count": 0, "campaign_key": "59f60144c1192f4f8627a2e8f031e0abfff43464", "event_fingerprint": "c37e053c60b8943d7fd0ba68ab217ea595677748", "classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 56, "precision_signals": [ "INT-cicd-jenkins" ], "kb_rule_ids": [ "INT-cicd-jenkins" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 55, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "8fa4db56c61e722d27d20b0a1aefcd95", "path_pattern_hash": "c9092f743328565e59631a2a8c600c06" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 55 }, "payload_preview": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "method": "GET", "path": "\/manage\/account\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/manage\/account\/login HTTP\/1.1", "request_sample": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "evidence": { "method": "GET", "path": "\/manage\/account\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/manage\/account\/login HTTP\/1.1", "request_sample": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d94b19f82f19a659191c68d283921299793addd3", "protocol_details": { "http_method": "GET", "http_path": "\/manage\/account\/login", "request_line": "GET \/manage\/account\/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "attack_vector": "jenkins probe \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/manage\/account\/login", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 55\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 55 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 55, "confidence_breakdown": { "waf": 100, "classification": 60, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 55, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 55, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "INT-cicd-jenkins" ], "tags_summary_labels_fr": [ "Cicd Jenkins" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/manage\/account\/login", "request_line": "GET \/manage\/account\/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "jenkins probe \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/manage\/account\/login", "evidence_snippet": "GET \/manage\/account\/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8085" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_admin_panel_probe", "net_web_probe" ] }
14/07/2026 17:11:46 UTC	TCP	8085 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:8085 · (tentative d'exploit) · → /admin/index.html	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /admin/index.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /admin/index.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible /admin/index.html Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 65 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass ET Magento admin ES admin GET ActiveMQ console Ligne de requête `GET /admin/index.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /admin/index.html HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nok Requête brute (extrait) GET /admin/index.html HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "4b0fa2b11fff9aad6a33a18fa912997e85ee3d7a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 189, "payload_entropy": 5.22004186356365, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 65, "tag_count": 9, "anomaly_count": 0, "campaign_key": "d047259a6ccb1a85ee9225a006bc919c37004ed4", "event_fingerprint": "2d1bc48ad25180463b247cadea127348a6b24804", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103", "pat-0854", "pat-0341", "pat-0606" ], "matched_pattern_names": [ "LFI Double-dot bypass", "ET Magento admin", "ES admin GET", "ActiveMQ console" ], "pattern_ids": [ "pat-0103", "pat-0854", "pat-0341", "pat-0606" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 65, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "4f61f71d636469628e82e7e77f0c3fe3", "path_pattern_hash": "f654a37a97b7cd890ed6641ca011c363" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "method": "GET", "path": "\/admin\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/admin\/index.html HTTP\/1.1", "request_sample": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "evidence": { "method": "GET", "path": "\/admin\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/admin\/index.html HTTP\/1.1", "request_sample": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "53043a8121b0a8d84244961aee4e937569eba9a6", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/index.html", "request_line": "GET \/admin\/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "attack_vector": "config file probe \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/index.html", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 65, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/index.html", "request_line": "GET \/admin\/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/index.html", "evidence_snippet": "GET \/admin\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nok", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8085" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_admin_panel_probe", "http_admin_panel_scan", "http_probe_admin", "http_sensitive_path", "net_web_probe" ] }
14/07/2026 17:11:46 UTC	TCP	8085 · HTTP	http	SSRF ssrf attack · via HTTP:8085 · (tentative d'exploit) · → /index.html	Élevée	Moyen · 54
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /index.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 net_web_probe Cible HTTP GET /index.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible /index.html Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 54 Confiance : Confiance 50 % — 3 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /index.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /index.html HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com Requête brute (extrait) GET /index.html HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "14fe4559026d4c5b5eb530ee70300c52d99e70d7", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 183, "payload_entropy": 5.228208174907092, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 84, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 54, "tag_count": 4, "anomaly_count": 0, "campaign_key": "afb30822fb050a2caf5c8c4a01c1c06dcb46acbb", "event_fingerprint": "829654742d918a993b110a7b3e698a7dafb5178e", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 54, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "aaf7f64a4d2acf94543b6caa2f51b851", "path_pattern_hash": "213456c5dc963e03ec1f27600c46c954" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 54 }, "payload_preview": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "method": "GET", "path": "\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/index.html HTTP\/1.1", "request_sample": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "evidence": { "method": "GET", "path": "\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/index.html HTTP\/1.1", "request_sample": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "49cfeb9e26166b041237bc9a9398aab8a026d8e1", "protocol_details": { "http_method": "GET", "http_path": "\/index.html", "request_line": "GET \/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "attack_vector": "ssrf attack \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/index.html", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 84, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 54, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 54, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/index.html", "request_line": "GET \/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/index.html", "evidence_snippet": "GET \/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8085" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "net_web_probe" ] }
14/07/2026 17:11:46 UTC	TCP	8085 · HTTP	http	SSRF ssrf attack · via HTTP:8085 · (tentative d'exploit) · → /+CSCOE+/logon.html	Élevée	Moyen · 60
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /+CSCOE+/logon.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /+CSCOE+/logon.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible /+CSCOE+/logon.html Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 60 Confiance : Confiance 50 % — 4 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /+CSCOE+/logon.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /+CSCOE+/logon.html HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.n Requête brute (extrait) GET /+CSCOE+/logon.html HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "2febb8a3c3d7f366eb236521e1eaa73748bc008b", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 191, "payload_entropy": 5.26981223874181, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 100, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 60, "tag_count": 5, "anomaly_count": 0, "campaign_key": "06d4a0f44310e29af5d3f2f8fe528f69de3faf81", "event_fingerprint": "3e1ffb544a0b497b0eedea5eba93c777e4a6f80c", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "f10967f47cd20b52faeef5916bdef7fb", "path_pattern_hash": "822b93c1de9180d86276e796ab5bb039" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "method": "GET", "path": "\/+CSCOE+\/logon.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1", "request_sample": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "evidence": { "method": "GET", "path": "\/+CSCOE+\/logon.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1", "request_sample": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c9671df0625b81d345e594293544ff6e3be402a8", "protocol_details": { "http_method": "GET", "http_path": "\/+CSCOE+\/logon.html", "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "attack_vector": "ssrf attack \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/+CSCOE+\/logon.html", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/+CSCOE+\/logon.html", "request_line": "GET \/+CSCOE+\/logon.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/+CSCOE+\/logon.html", "evidence_snippet": "GET \/+CSCOE+\/logon.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.n", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8085" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "net_web_probe" ] }
14/07/2026 17:11:46 UTC	TCP	8085 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:8085 · (tentative d'exploit) · → /cgi-bin/login.cgi	Élevée	Moyen · 64
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /cgi-bin/login.cgi UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /cgi-bin/login.cgi TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible /cgi-bin/login.cgi Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 64 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /cgi-bin/login.cgi HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /cgi-bin/login.cgi HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.no Requête brute (extrait) GET /cgi-bin/login.cgi HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "cgi", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "4ed67956bf1afbdf7ecfacd9a5462fa4568ad191", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 190, "payload_entropy": 5.185726675921509, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 64, "tag_count": 8, "anomaly_count": 0, "campaign_key": "0f1458d2f3cb3f4831a208e35e5366b075e3f170", "event_fingerprint": "370f4526b01844f985ecb405f11a7dc7798cfd00", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "941014099b047d33de788aaed76940b0", "path_pattern_hash": "0254f935cc3e30d1c750bc16ae1de8fe" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 64 }, "payload_preview": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "method": "GET", "path": "\/cgi-bin\/login.cgi", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1", "request_sample": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "evidence": { "method": "GET", "path": "\/cgi-bin\/login.cgi", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1", "request_sample": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2355a7a2708ecd524555a9ccd94c327c0d2a1de8", "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/login.cgi", "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "attack_vector": "config file probe \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/login.cgi", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 64, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 64, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/cgi-bin\/login.cgi", "request_line": "GET \/cgi-bin\/login.cgi HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/login.cgi", "evidence_snippet": "GET \/cgi-bin\/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.no", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8085" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_probe_cgi_bin", "http_sensitive_path", "iot_http_endpoint", "net_web_probe" ] }
14/07/2026 17:11:46 UTC	TCP	8085 · HTTP	http	jenkins probe jenkins probe · via HTTP:8085 · (sonde / probe) · → /login.htm	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /login.htm UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 net_web_probe Cible HTTP GET /login.htm TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible /login.htm Service HTTP Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47% Confiance classification 55% Corrélation +8 Risque capteur Moyen · 47 Confiance : Confiance 47 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux Cicd Jenkins Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /login.htm HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /login.htm HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/ Requête brute (extrait) GET /login.htm HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "htm", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "a080cb0dd1e1d6f0c7467b3267535b1479975617", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 182, "payload_entropy": 5.205436122728411, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 84, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 47, "tag_count": 4, "anomaly_count": 0, "campaign_key": "afb30822fb050a2caf5c8c4a01c1c06dcb46acbb", "event_fingerprint": "d09454de0cac4ff8ebd3b332f6df8a2901f5baef", "classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 56, "precision_signals": [ "INT-cicd-jenkins" ], "kb_rule_ids": [ "INT-cicd-jenkins" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "c77d732e6bf8a43f661a51edacfa1888", "path_pattern_hash": "8d9104962905da3abf94ae1977aa5733" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 47 }, "payload_preview": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "method": "GET", "path": "\/login.htm", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.htm HTTP\/1.1", "request_sample": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "evidence": { "method": "GET", "path": "\/login.htm", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.htm HTTP\/1.1", "request_sample": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c427957f1b1cde315ed38af1c194b91e784719bc", "protocol_details": { "http_method": "GET", "http_path": "\/login.htm", "request_line": "GET \/login.htm HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "attack_vector": "jenkins probe \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login.htm", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "INT-cicd-jenkins" ], "tags_summary_labels_fr": [ "Cicd Jenkins" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/login.htm", "request_line": "GET \/login.htm HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "jenkins probe \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login.htm", "evidence_snippet": "GET \/login.htm HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8085" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "net_web_probe" ] }
14/07/2026 17:11:46 UTC	TCP	8085 · HTTP	http	jenkins probe jenkins probe · via HTTP:8085 · (sonde / probe) · → /login.html	Élevée	Moyen · 47
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /login.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 net_web_probe Cible HTTP GET /login.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible /login.html Service HTTP Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47% Confiance classification 55% Corrélation +8 Risque capteur Moyen · 47 Confiance : Confiance 47 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux Cicd Jenkins Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /login.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /login.html HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com Requête brute (extrait) GET /login.html HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "58165cf539b8f3baebb7b0688b61c0c6bd9c1221", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 183, "payload_entropy": 5.203290222821372, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 84, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 47, "tag_count": 4, "anomaly_count": 0, "campaign_key": "afb30822fb050a2caf5c8c4a01c1c06dcb46acbb", "event_fingerprint": "5c88a946928b56c503e93409ccd9b3488e69fe43", "classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 56, "precision_signals": [ "INT-cicd-jenkins" ], "kb_rule_ids": [ "INT-cicd-jenkins" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "838de38a43bbc8c9c91d7bc7f457ac0a", "path_pattern_hash": "4bd05a9ef933daa96fd6cd3e76e0cd59" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 47 }, "payload_preview": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "method": "GET", "path": "\/login.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.html HTTP\/1.1", "request_sample": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "evidence": { "method": "GET", "path": "\/login.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.html HTTP\/1.1", "request_sample": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "35d493c7978dd76637dd5920be47c7db2f14bc99", "protocol_details": { "http_method": "GET", "http_path": "\/login.html", "request_line": "GET \/login.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "attack_vector": "jenkins probe \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login.html", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 47\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 47, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 47, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "INT-cicd-jenkins" ], "tags_summary_labels_fr": [ "Cicd Jenkins" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/login.html", "request_line": "GET \/login.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "jenkins probe \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login.html", "evidence_snippet": "GET \/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8085" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "net_web_probe" ] }
14/07/2026 17:11:46 UTC	TCP	8085 · HTTP	http	jenkins probe jenkins probe · via HTTP:8085 · (sonde / probe) · → /login.jsp	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /login.jsp UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 http_probe_login Cible HTTP GET /login.jsp TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible /login.jsp Service HTTP Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47% Confiance classification 55% Corrélation +8 Risque capteur Moyen · 48 Confiance : Confiance 47 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux Cicd Jenkins Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /login.jsp HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /login.jsp HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/ Requête brute (extrait) GET /login.jsp HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "jsp", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "b41f25730b5d6fa1c33072bb9c8d43aa7ba33e8e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 182, "payload_entropy": 5.220891666642185, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 84, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 48, "tag_count": 5, "anomaly_count": 0, "campaign_key": "21917a95d927b09841819dc128bd7c248b49fb36", "event_fingerprint": "2066cf2d54ed74de22655d2358354a2453916607", "classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 56, "precision_signals": [ "INT-cicd-jenkins" ], "kb_rule_ids": [ "INT-cicd-jenkins" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 48, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "e8df2a0165c3c2e62869502407dd930d", "path_pattern_hash": "b16b806d2fba9e3fd94bdb22d055d68f" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 48 }, "payload_preview": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "method": "GET", "path": "\/login.jsp", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.jsp HTTP\/1.1", "request_sample": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "evidence": { "method": "GET", "path": "\/login.jsp", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login.jsp HTTP\/1.1", "request_sample": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5aa77c8a287a188198347f2625bd8d99478ce8c3", "protocol_details": { "http_method": "GET", "http_path": "\/login.jsp", "request_line": "GET \/login.jsp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "attack_vector": "jenkins probe \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login.jsp", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 48, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 48, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "INT-cicd-jenkins" ], "tags_summary_labels_fr": [ "Cicd Jenkins" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/login.jsp", "request_line": "GET \/login.jsp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "jenkins probe \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login.jsp", "evidence_snippet": "GET \/login.jsp HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8085" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "http_probe_login", "net_web_probe" ] }
14/07/2026 17:11:46 UTC	TCP	8085 · HTTP	http	jenkins probe jenkins probe · via HTTP:8085 · (sonde / probe) · → /login	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole GET /login UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 http_probe_login Cible HTTP GET /login TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible /login Service HTTP Pourquoi cette classification : Type « jenkins_probe » (signaux protocolaires) · confiance 47% Confiance classification 55% Corrélation +8 Risque capteur Moyen · 48 Confiance : Confiance 47 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux Cicd Jenkins Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /login HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /login HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/geno Requête brute (extrait) GET /login HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "c42c80aa06113268fddf90dfdc871fb7318ff5cf", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 178, "payload_entropy": 5.203026862727193, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 84, "risk_classification": 54, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 48, "tag_count": 5, "anomaly_count": 0, "campaign_key": "21917a95d927b09841819dc128bd7c248b49fb36", "event_fingerprint": "44c513aaf2adbc28617cb0cfadbf67cf82ca3003", "classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 56, "precision_signals": [ "INT-cicd-jenkins" ], "kb_rule_ids": [ "INT-cicd-jenkins" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 48, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "cd9389d5abf158b8c35bfc8641e32bad", "path_pattern_hash": "7e93fba0bc7adda858a2500090e639e4" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 48 }, "payload_preview": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "method": "GET", "path": "\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login HTTP\/1.1", "request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "evidence": { "method": "GET", "path": "\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/login HTTP\/1.1", "request_sample": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a4c3329481ad02a7acfe5c0599356d32db2cf2ed", "protocol_details": { "http_method": "GET", "http_path": "\/login", "request_line": "GET \/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "attack_vector": "jenkins probe \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab jenkins_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 84, "classification": 54, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 48, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 48, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "INT-cicd-jenkins" ], "tags_summary_labels_fr": [ "Cicd Jenkins" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/login", "request_line": "GET \/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "jenkins probe \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/login", "evidence_snippet": "GET \/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/geno", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8085" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "http_probe_login", "net_web_probe" ] }
14/07/2026 17:11:46 UTC	TCP	8085 · HTTP	http	SSRF ssrf attack · via HTTP:8085 · (tentative d'exploit) · → /doc/index.html	Élevée	Moyen · 60
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /doc/index.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /doc/index.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible /doc/index.html Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 60 Confiance : Confiance 50 % — 4 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /doc/index.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /doc/index.html HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia Requête brute (extrait) GET /doc/index.html HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "94cbd295967620830d1ac8eefc3dab9ec7f6dbc6", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 187, "payload_entropy": 5.218316588578756, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 100, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 60, "tag_count": 5, "anomaly_count": 0, "campaign_key": "06d4a0f44310e29af5d3f2f8fe528f69de3faf81", "event_fingerprint": "d6893024a09da08a5cb1f410b7b4623f744a872d", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "7b526806eb6c86cc47f2782ff085b199", "path_pattern_hash": "a7598671652528e5b3f1e930e03e0a00" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia", "method": "GET", "path": "\/doc\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/doc\/index.html HTTP\/1.1", "request_sample": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia", "evidence": { "method": "GET", "path": "\/doc\/index.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/doc\/index.html HTTP\/1.1", "request_sample": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "667cecaa23935335e9cc4f4a84e01cbc378a7e48", "protocol_details": { "http_method": "GET", "http_path": "\/doc\/index.html", "request_line": "GET \/doc\/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia", "attack_vector": "ssrf attack \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/doc\/index.html", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/doc\/index.html", "request_line": "GET \/doc\/index.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/doc\/index.html", "evidence_snippet": "GET \/doc\/index.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8085" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "net_web_probe" ] }
14/07/2026 17:11:46 UTC	TCP	8085 · HTTP	http	Contournement Fortinet fortinet auth bypass · via HTTP:8085 · (tentative d'exploit) · → /remote/login	Élevée	Élevé · 66
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1190 TA0001 TA0002 Protocole GET /remote/login UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /remote/login TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible /remote/login Service HTTP Pourquoi cette classification : Type « fortinet_auth_bypass » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 66 Confiance : Confiance 100 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux ET-EXPLOIT-Fortinet Path Fortinet pat-0721 Technique MITRE T1190 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CVE-2024-21762 FortiOS MITRE T1210 remote svc LFI Double-dot bypass Ligne de requête `GET /remote/login HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /remote/login HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.c Requête brute (extrait) GET /remote/login HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "907a2da0c21f11374cb55d43385e76e234aedbef", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 185, "payload_entropy": 5.176401410915235, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 100, "risk_classification": 86, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 6.1, "risk_breakdown": { "waf": 100, "classification": 86, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 66, "tag_count": 6, "anomaly_count": 0, "campaign_key": "40e6ac113e0d8a96130ec9d6da74e0c4f02ecffe", "event_fingerprint": "5ab8ad62967d67de005feea6b2ee5b4874e89d70", "classification_reason": "Type \u00ab fortinet_auth_bypass \u00bb (signaux protocolaires) \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 246, "precision_signals": [ "ET-EXPLOIT-Fortinet", "INT-path-fortinet", "pat-0721" ], "kb_rule_ids": [ "ET-EXPLOIT-Fortinet", "INT-path-fortinet", "pat-0721" ], "matched_patterns": [ "pat-0721", "pat-0803", "pat-0103" ], "matched_pattern_names": [ "CVE-2024-21762 FortiOS", "MITRE T1210 remote svc", "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0721", "pat-0803", "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 86, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 66, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "02269e65f4a14dae894aa7ef984a351a", "path_pattern_hash": "3e486ce7203b6fa4cdeca113b89969b2" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 66 }, "payload_preview": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "method": "GET", "path": "\/remote\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/remote\/login HTTP\/1.1", "request_sample": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "evidence": { "method": "GET", "path": "\/remote\/login", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/remote\/login HTTP\/1.1", "request_sample": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "classification_reason": "Type \u00ab fortinet_auth_bypass \u00bb (signaux protocolaires) \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1190" ], "mitre": "T1190", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "33cd62db27d28faa25789ba66c9d01d5ac7246e6", "protocol_details": { "http_method": "GET", "http_path": "\/remote\/login", "request_line": "GET \/remote\/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "attack_vector": "fortinet auth bypass \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/remote\/login", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab fortinet_auth_bypass \u00bb (signaux protocolaires) \u00b7 confiance 100%", "classification_reason_label_fr": "Type \u00ab fortinet_auth_bypass \u00bb (signaux protocolaires) \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 66\/100 (\u00c9lev\u00e9) \u2014 MITRE T1190 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 86, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 66, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 66, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "ET-EXPLOIT-Fortinet", "INT-path-fortinet", "pat-0721" ], "tags_summary_labels_fr": [ "ET-EXPLOIT-Fortinet", "Path Fortinet", "pat-0721" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1190", "mitre_technique": "T1190", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/remote\/login", "request_line": "GET \/remote\/login HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "fortinet auth bypass \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/remote\/login", "evidence_snippet": "GET \/remote\/login HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.c", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8085" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_vpn_portal_scan", "net_web_probe" ] }
14/07/2026 17:11:46 UTC	TCP	8085 · HTTP	http	Sonde fichier configuration config file probe · via HTTP:8085 · (tentative d'exploit) · → /admin/login.asp	Élevée	Élevé · 65
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1083 TA0001 TA0002 Protocole GET /admin/login.asp UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /admin/login.asp TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible /admin/login.asp Service HTTP Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Élevé · 65 Confiance : Confiance 100 % — 4 tag(s) WAF Protocole émulé 1 Signaux Http Sensitive Upstream Waf Score Technique MITRE T1083 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass ET Magento admin ES admin GET Probe /admin/login ActiveMQ console Ligne de requête `GET /admin/login.asp HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /admin/login.asp HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.noki Requête brute (extrait) GET /admin/login.asp HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "asp", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "74ee0e33710b439680e8c9dc84b7100d7e7738f2", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 188, "payload_entropy": 5.194789579589839, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 100, "risk_classification": 74, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 65, "tag_count": 9, "anomaly_count": 0, "campaign_key": "d047259a6ccb1a85ee9225a006bc919c37004ed4", "event_fingerprint": "2dce00758b0a08356ec52243e45182ddea217f3f", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "confidence": 1, "classification_confidence": 1, "precision_score": 127, "precision_signals": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103", "pat-0854", "pat-0341", "pat-0237", "pat-0606" ], "matched_pattern_names": [ "LFI Double-dot bypass", "ET Magento admin", "ES admin GET", "Probe \/admin\/login", "ActiveMQ console" ], "pattern_ids": [ "pat-0103", "pat-0854", "pat-0341", "pat-0237", "pat-0606" ], "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 65, "correlation_boost": 8 }, "named_classification_skipped": false, "classification_parent": "backup_file_scan", "service_name": "http", "risk_confidence_factor": 100, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "1c0cbd283255dd2064d8bd39b321bf3b", "path_pattern_hash": "742c42cda425189da92779d492183288" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 65 }, "payload_preview": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "method": "GET", "path": "\/admin\/login.asp", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/admin\/login.asp HTTP\/1.1", "request_sample": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "evidence": { "method": "GET", "path": "\/admin\/login.asp", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/admin\/login.asp HTTP\/1.1", "request_sample": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre_techniques": [ "T1083" ], "mitre": "T1083", "threat_family": [ "path_traversal", "config_leak_scan" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "83d34abc609332088d6ea2e8d4930a0392448d9e", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/login.asp", "request_line": "GET \/admin\/login.asp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "attack_vector": "config file probe \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/login.asp", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 65\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 74, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 65, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 65, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "INT-http_sensitive", "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Http Sensitive", "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "T1083", "mitre_technique": "T1083", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/admin\/login.asp", "request_line": "GET \/admin\/login.asp HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "config file probe \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/login.asp", "evidence_snippet": "GET \/admin\/login.asp HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.noki", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8085" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "http_admin_panel_probe", "http_admin_panel_scan", "http_probe_admin", "http_sensitive_path", "net_web_probe" ] }
14/07/2026 17:11:46 UTC	TCP	8085 · HTTP	http	SSRF ssrf attack · via HTTP:8085 · (tentative d'exploit) · → /web/	Élevée	Moyen · 60
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /web/ UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /web/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible /web/ Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 60 Confiance : Confiance 50 % — 4 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /web/ HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /web/ HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genom Requête brute (extrait) GET /web/ HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "be2a319b834b23bb5db3b9088093e167eb951dfe", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 177, "payload_entropy": 5.208531612818487, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 100, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 60, "tag_count": 5, "anomaly_count": 0, "campaign_key": "06d4a0f44310e29af5d3f2f8fe528f69de3faf81", "event_fingerprint": "4b9565f060896e755123f537c60c4efdf4e1a14d", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "242e870f50b24f6d588b66901bb7c440", "path_pattern_hash": "d10f26a614111c156a22417b020f287c" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genom", "method": "GET", "path": "\/web\/", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/web\/ HTTP\/1.1", "request_sample": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genom", "evidence": { "method": "GET", "path": "\/web\/", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/web\/ HTTP\/1.1", "request_sample": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genom", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3f529b7a38e907dd5f88d86c9c66f316e06bbd42", "protocol_details": { "http_method": "GET", "http_path": "\/web\/", "request_line": "GET \/web\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genom", "attack_vector": "ssrf attack \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/web\/", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/web\/", "request_line": "GET \/web\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/web\/", "evidence_snippet": "GET \/web\/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genom", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8085" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "net_web_probe" ] }
14/07/2026 17:11:46 UTC	TCP	8085 · HTTP	http	SSRF ssrf attack · via HTTP:8085 · (tentative d'exploit) · → /webpages/login.html	Élevée	Moyen · 60
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /webpages/login.html UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 25 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950468:nosqli-3 950470:nosqli-3 Cible HTTP GET /webpages/login.html TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible /webpages/login.html Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 60 Confiance : Confiance 50 % — 4 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET /webpages/login.html HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 Payload (extrait) GET /webpages/login.html HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www. Requête brute (extrait) GET /webpages/login.html HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": "html", "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "3557966eb4cf90eaeaf0c2c998dc2912f0a3d646", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 192, "payload_entropy": 5.196431751810375, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 100, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 60, "tag_count": 5, "anomaly_count": 0, "campaign_key": "06d4a0f44310e29af5d3f2f8fe528f69de3faf81", "event_fingerprint": "b57bb555a3aa14d1a6d0c46eadac51173d1290d8", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "42d56b61f3f6ac70802e6afd6b55d352", "path_pattern_hash": "048ac28c307da42b70c2a2400dc8fdcb" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 60 }, "payload_preview": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "method": "GET", "path": "\/webpages\/login.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/webpages\/login.html HTTP\/1.1", "request_sample": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "evidence": { "method": "GET", "path": "\/webpages\/login.html", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3" ], "request_line": "GET \/webpages\/login.html HTTP\/1.1", "request_sample": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3d3c113c60ce99c0b3a47e2ee147f89719929d35", "protocol_details": { "http_method": "GET", "http_path": "\/webpages\/login.html", "request_line": "GET \/webpages\/login.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "attack_vector": "ssrf attack \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/webpages\/login.html", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 100, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 60, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 60, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/webpages\/login.html", "request_line": "GET \/webpages\/login.html HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/webpages\/login.html", "evidence_snippet": "GET \/webpages\/login.html HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8085" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950468:nosqli-3", "950470:nosqli-3", "net_web_probe" ] }
14/07/2026 17:11:45 UTC	TCP	8085 · HTTP	http	SSRF ssrf attack · via HTTP:8085 · (tentative d'exploit)	Élevée	Moyen · 59
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET / UA Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia… Émulateur HTTP WAF 22 Recommandation Investiguer Tags 950326:rce-0 950406:ssrf-3 950470:nosqli-3 950734:sap-sapcontrol-path Cible HTTP GET / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 8085 Chemin / cible / Service HTTP Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 59 Confiance : Confiance 50 % — 4 tag(s) WAF Protocole émulé 1 Signaux Upstream Waf Score Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) LFI Double-dot bypass Ligne de requête `GET / HTTP/1.1` User-Agent Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Règles WAF rce-0 ssrf-3 nosqli-3 sap-sapcontrol-path Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecra Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:8085 User-Agent: Mozilla/5.0 (compatible; GenomeCrawlerd/1.0; +https://www.nokia.com/genomecrawler) Accept: / Accept-Encoding: gzip Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 4, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "731a54d05d15c937e70ce5f27b0e2782c77e3cc2", "http_host_hash": "8307e910dac7083f4f0d52abcc8375f89d55b254", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 173, "payload_entropy": 5.212311319259246, "port_category": "registered", "org": "Scaleway SAS", "service": "http", "app_proto": "http", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 96, "risk_classification": 84, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 5.8, "risk_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25 }, "risk_score": 59, "tag_count": 5, "anomaly_count": 0, "campaign_key": "70a20b7b3256e4806d4af99da8996e39384811d9", "event_fingerprint": "39c99d4b4fdb21eb120522806aac6037ded76a1f", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "confidence": 0.58, "classification_confidence": 0.58, "precision_score": 55, "precision_signals": [ "INT-upstream", "INT-waf-score" ], "kb_rule_ids": [ "INT-upstream", "INT-waf-score" ], "matched_patterns": [ "pat-0103" ], "matched_pattern_names": [ "LFI Double-dot bypass" ], "pattern_ids": [ "pat-0103" ], "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b11f3db78df44fd591148f05e0b8a7be", "payload_hash": "4a2fe03078715989e1bc67d613fd89d2", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 59 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecra", "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecra", "evidence": { "method": "GET", "path": "\/", "user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "waf_tags": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "rce-0", "ssrf-3", "nosqli-3", "sap-sapcontrol-path" ], "request_line": "GET \/ HTTP\/1.1", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)\r\nAccept: \/\r\nAccept-Encoding: gzip\r\n\r\n", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecra", "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6b208e7ab0a8edd69725f45b6692ccaef4a35e25", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecra", "attack_vector": "ssrf attack \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit)", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "classification_reason_label_fr": "R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 58 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 58, "confidence_breakdown": { "waf": 96, "classification": 84, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 25, "risk_score": 59, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 59, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "INT-upstream", "INT-waf-score" ], "tags_summary_labels_fr": [ "Upstream", "Waf Score" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/", "request_line": "GET \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecrawler)", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "ssrf attack \u00b7 via HTTP:8085 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8085\r\nUser-Agent: Mozilla\/5.0 (compatible; GenomeCrawlerd\/1.0; +https:\/\/www.nokia.com\/genomecra", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 50 % \u2014 4 tag(s) WAF", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "http-alt-8085" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950406:ssrf-3", "950470:nosqli-3", "950734:sap-sapcontrol-path", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
14/07/2026 17:11:40 UTC	TCP	8085 · HTTP ALT 8085	http-alt-8085	Sonde PostgreSQL postgres probe · via HTTP ALT 8085:8085 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTP-ALT-8085 WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8085 Chemin / cible — Service HTTP ALT 8085 Payload ��J�O5qf$�&_m��V��s94F�U��;T�& )n/%�E�D-.v�0k�� I�Ƈ��o��&̨̩�/�0�+�,�� /5� � Pourquoi cette classification :* Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��J�O5qf$�&_m��V��s94F�U��;T�& )n/%�E�D-.v�0k�� I�Ƈ��o��&̨̩�/�0�+�,�� /5� � Requête brute (extrait) ��J�O5qf$�&_m��V��s94F�U��;T�& )n/%�E�D-.v�0k�� I�Ƈ��o��&̨̩�/�0�+�,�� /5� � � http/1.1+ 3&$ A��:{ �� T}c�C,�ga�� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 258, "payload_entropy": 5.8767734122982835, "port_category": "registered", "org": "Scaleway SAS", "service": "http-alt-8085", "app_proto": "http-alt-8085", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "066ef400f0889f954fd106c56647d3ef1044c668", "event_fingerprint": "c7cbcc11dfcc2ec50410999dad51ff26e4ec6e62", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "http-alt-8085", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a937656628a70aac772ef52e1de8d016", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 8085, "service": "http-alt-8085", "service_name": "http-alt-8085", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003J\ufffdO5qf$\ufffd&_m\ufffd\u0000\ufffdV\ufffd\ufffd\ufffds94F\u0013\ufffdU\ufffd\ufffd;T\ufffd& )n\/%\u0004\ufffdE\ufffdD-.v\ufffd0k\ufffd\u001f\ufffd\ufffd\n\u0017I\ufffd\u0187\ufffd\ufffdo\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003J\ufffdO5qf$\ufffd&_m\ufffd\u0000\ufffdV\ufffd\ufffd\ufffds94F\u0013\ufffdU\ufffd\ufffd;T\ufffd& )n\/%\u0004\ufffdE\ufffdD-.v\ufffd0k\ufffd\u001f\ufffd\ufffd\n\u0017I\ufffd\u0187\ufffd\ufffdo\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\ufffd\u0001\u0000\u0001\u0000\u0000\u0010\u0000\u000b\u0000\t\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 \u000fA\ufffd\ufffd\ufffd\ufffd:{\r\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffdT}c\ufffdC,\u0006\u0013\ufffdga\ufffd\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003J\ufffdO5qf$\ufffd&_m\ufffd\u0000\ufffdV\ufffd\ufffd\ufffds94F\u0013\ufffdU\ufffd\ufffd;T\ufffd& )n\/%\u0004\ufffdE\ufffdD-.v\ufffd0k\ufffd\u001f\ufffd\ufffd\n\u0017I\ufffd\u0187\ufffd\ufffdo\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f69757bde9590f9195b9c34590ce5dd0b55c2dc5", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003J\ufffdO5qf$\ufffd&_m\ufffd\u0000\ufffdV\ufffd\ufffd\ufffds94F\u0013\ufffdU\ufffd\ufffd;T\ufffd& )n\/%\u0004\ufffdE\ufffdD-.v\ufffd0k\ufffd\u001f\ufffd\ufffd\n\u0017I\ufffd\u0187\ufffd\ufffdo\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "port": 8085, "service": "http-alt-8085", "service_label_fr": "HTTP ALT 8085" }, "evidence_snippet": "\ufffd\ufffdJ\ufffdO5qf$\ufffd&_m\ufffd\ufffdV\ufffd\ufffd\ufffds94F\ufffdU\ufffd\ufffd;T\ufffd& )n\/%\ufffdE\ufffdD-.v\ufffd0k\ufffd\ufffd\ufffd\nI\ufffd\u0187\ufffd\ufffdo\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd", "attack_vector": "postgres probe \u00b7 via HTTP ALT 8085:8085 \u00b7 (sonde \/ probe)", "target_port_label": "8085 \u00b7 HTTP ALT 8085", "emulator_service": "http-alt-8085", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "http-alt-8085", "service_label_fr": "HTTP ALT 8085", "dst_port": 8085, "protocol_emulated": true, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8085", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003J\ufffdO5qf$\ufffd&_m\ufffd\u0000\ufffdV\ufffd\ufffd\ufffds94F\u0013\ufffdU\ufffd\ufffd;T\ufffd& )n\/%\u0004\ufffdE\ufffdD-.v\ufffd0k\ufffd\u001f\ufffd\ufffd\n\u0017I\ufffd\u0187\ufffd\ufffdo\ufffd\ufffd\u0000&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\u0013\ufffd\t\ufffd\u0014\ufffd\n\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0003\u0013\u0001\u0013\u0002\u0001\u0000\u0000\ufffd\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "port": 8085, "service": "http-alt-8085", "service_label_fr": "HTTP ALT 8085" }, "attack_vector": "postgres probe \u00b7 via HTTP ALT 8085:8085 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdJ\ufffdO5qf$\ufffd&_m\ufffd\ufffdV\ufffd\ufffd\ufffds94*F\ufffdU\ufffd\ufffd;T\ufffd& )n\/%\ufffdE\ufffdD-.v\ufffd0k\ufffd\ufffd\ufffd\nI\ufffd\u0187\ufffd\ufffdo\ufffd\ufffd&\u0328\u0329\ufffd\/\ufffd0\ufffd+\ufffd,\ufffd\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\/5\ufffd\n\ufffd", "target_port_label": "8085 \u00b7 HTTP ALT 8085", "emulator_service": "http-alt-8085", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8085", "service_banner": "honeypot-http-alt-8085", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ] }
14/07/2026 17:11:32 UTC	TCP	8085 · HTTP ALT 8085	http-alt-8085	http-alt-8085 http-alt-8085 · via HTTP ALT 8085:8085 · (sonde / probe)	Faible	Faible · 0
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTP-ALT-8085 WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8085 Chemin / cible — Service HTTP ALT 8085 Pourquoi cette classification : Type « http-alt-8085 » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 0 Confiance : Confiance faible (0 %) — classification prudente Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Scaleway SAS", "service": "http-alt-8085", "app_proto": "http-alt-8085", "asn": 12876, "country": "FR", "dst_port": 8085, "risk_waf": 8, "risk_classification": 0, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 22, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0 }, "risk_score": 0, "tag_count": 0, "anomaly_count": 0, "campaign_key": "22265b2478869482eb9206249e1fe16334e71a55", "event_fingerprint": "c7cbcc11dfcc2ec50410999dad51ff26e4ec6e62", "classification_reason": "Type \u00ab http-alt-8085 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "named_classification_skipped": false, "service_name": "http-alt-8085", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 12876, "org": "Scaleway SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "ca3ed27f3cd9f08f71b26155e5d4190c" }, "target_context": { "dst_port": 8085, "service": "http-alt-8085", "service_name": "http-alt-8085", "risk_score": 0 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8fad20c307724c90a9d0207eaf20c8ea23b1a531", "protocol_details": { "port": 8085, "service": "http-alt-8085", "service_label_fr": "HTTP ALT 8085" }, "attack_vector": "http-alt-8085 \u00b7 via HTTP ALT 8085:8085 \u00b7 (sonde \/ probe)", "target_port_label": "8085 \u00b7 HTTP ALT 8085", "emulator_service": "http-alt-8085", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "site_display": { "classification": null, "classification_reason": "Type \u00ab http-alt-8085 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab http-alt-8085 \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 0, "behavior": 0, "geo": 0, "protocol": 22, "novelty": 0, "risk_score": 0 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 0, "risk_label": "Faible", "service_name": "http-alt-8085", "service_label_fr": "HTTP ALT 8085", "dst_port": 8085, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8085", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 8085, "service": "http-alt-8085", "service_label_fr": "HTTP ALT 8085" }, "attack_vector": "http-alt-8085 \u00b7 via HTTP ALT 8085:8085 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "8085 \u00b7 HTTP ALT 8085", "emulator_service": "http-alt-8085", "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8085", "service_banner": "honeypot-http-alt-8085", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }

51.159.125.208

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence