Renseignement sur les menaces

États-Unis

64.89.161.90

FAI Ghosty Networks LLC Première vue 29/06/2026 06:00 UTC Dernière vue 23/07/2026 17:36 UTC Risque Moyen

Période analysée : 2026-04-24 → 2026-07-23

Activité suspecte · risque 40/100

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 50/100 Moyen

Première observation 29/06/2026 06:00 UTC

Dernière observation 23/07/2026 17:36 UTC

Événements (période) 303

MITRE ATT&CK principal TA0007 251 occurrences

Activité suspecte · risque 40/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « web_probe » (signaux protocolaires) · confiance 77%

Confiance 77 % — Score WAF 8

Comparaison ASN / FAI

ASN 205759 · 64.89.161.0/24 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 303 événements sur la période pour cette IP.

64.89.161.93 Sonde HTTP 23/07/2026 08:58 UTC
64.89.161.91 Sonde SSH 23/07/2026 08:21 UTC
64.89.160.135 Sonde port 22/TCP 23/07/2026 01:35 UTC
64.89.160.111 proxy probe 22/07/2026 06:45 UTC
64.89.160.199 Sonde port 25/TCP 22/07/2026 03:57 UTC
43.228.157.211 Sonde port 5900/TCP 21/07/2026 06:00 UTC
43.228.157.180 Sonde port 5900/TCP 21/07/2026 05:48 UTC
43.228.157.133 Sonde port 5900/TCP 21/07/2026 05:36 UTC

Événements (filtres)

303

Première observation

29/06/2026 06:00 UTC

Dernière observation

23/07/2026 17:36 UTC

Dernière activité (filtres)

23/07/2026 17:36 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 164 HDFS NAMENODE TCP 25 HTTPS TCP 21 MEMCACHED ALT TCP 12 CONSUL WAN TCP 7 XMPP SERVER TCP 4 SAP MS TCP 3 SSH TCP 3 SOCKS5 TCP 2 SQUID TCP 1 HTTP ALT 8090 TCP 1

HTTP

164

HDFS NAMENODE

HTTPS

MEMCACHED ALT

CONSUL WAN

XMPP SERVER

Géolocalisation

Origine réseau déclarée

États-Unis unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Ghosty Networks LLC 0 Port 8081 web_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

Sonde HTTP · via HTTP:8081 · (sonde / probe) · → 64.89.161.90:80

Détails protocole

Méthode: CONNECT
Chemin: 64.89.161.90:80

Aperçu payload

CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic MTox

Port / service

8081 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 77 % — Score WAF 8

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Confiance

77%

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

303 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

303 événement(s) — page 5/7

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
05/07/2026 05:05:14 UTC	TCP	8085 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8085 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8085 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic YWRtaW46YWRtaW5AMTIz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.098493691966581, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8085, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "b7f5690cc43930be753cd0a267cddc9c5ad7c843", "event_fingerprint": "e1ba2b9de9860d717c11232a8be20f7cadbfb54f", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ecd7fb4f167263d9e1e46051c3334cda", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8085, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW5AMTIz\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW5AMTIz\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW5AMTIz", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW5AMTIz\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW5AMTIz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "833937679a842bf3a286b89dbbecbfc5017fa900", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW5AMTIz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8085, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8085, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8085 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW5AMTIz", "target_port_label": "8085 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8085" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
30/06/2026 23:37:36 UTC	TCP	3128 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:3128 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic MTIzNDU6MTIzNDU= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.066167128399962, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 3128, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "9d98deae613f6a509b02e181d77dc23f08d86689", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "fa2700a7b1adae0f4a7b82c2d129c972", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2b7da690fcc0e26942ca11824c397d2ec6fa269b", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
30/06/2026 23:34:38 UTC	TCP	3128 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:3128 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic dXNlcjp1c2VyMTIz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.1677465410616925, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 3128, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "9d98deae613f6a509b02e181d77dc23f08d86689", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "53b0aa056c269082c126f6725d991360", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9c6b92bac038244e73f0017124f8f9d0242bd5fa", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "squid" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
30/06/2026 23:32:14 UTC	TCP	3128 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:3128 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 34, "payload_entropy": 4.0796786498829745, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 3128, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "9d98deae613f6a509b02e181d77dc23f08d86689", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ea4c1f14c0572be8ae54ef2dcba5f35", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "267dda25a9537e7bce4f48aaf65d64208931075e", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "squid" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
30/06/2026 23:29:43 UTC	TCP	3128 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:3128 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic dXNlcjpzaGFkb3c= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 102, "payload_entropy": 5.235959597902659, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 3128, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "9d98deae613f6a509b02e181d77dc23f08d86689", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5fd59cdaceb61a8510f13dfae08452e2", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2115d665258dca3acba7643229dc6dd880deb038", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjpzaGFkb3c=", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "squid" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
30/06/2026 23:29:41 UTC	TCP	3128 · SQUID	squid	Sonde Squid proxy squid probe · via SQUID:3128 · (sonde / probe)	Élevée	Faible · 34
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur SQUID WAF — Recommandation Surveiller Tags net_squid_probe squid_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3128 Chemin / cible — Service SQUID Pourquoi cette classification : Type « squid_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 34 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e31203430372050726f78792041757468656e7469636174696f6e2052657175697265640d0a50726f78792d41757468656e7469636174653a204261736963207265616c6d3d227371756964220d0a436f6e74656e742d4c656e6774683a2034360d0a0d0a3c68746d6c3e3c626f64793e53717569642070726f", "emulator_response_len": 153, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "squid", "app_proto": "squid", "asn": 205759, "country": "US", "dst_port": 3128, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 34, "tag_count": 2, "anomaly_count": 0, "campaign_key": "e2ba725f06044d13c39b40bcf94cb8617a3b705a", "event_fingerprint": "81586bffa6e86d9c12ce9b39f0f0b836967cb06f", "classification_reason": "Type \u00ab squid_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 34 }, "named_classification_skipped": false, "service_name": "squid", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "9e572cafeeabbd95104cd808285e515e" }, "target_context": { "dst_port": 3128, "service": "squid", "service_name": "squid", "risk_score": 34 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "network_service_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9cb09d5ee9811018cd2c8ef9552616d9104654a1", "protocol_details": { "port": 3128, "service": "squid", "service_label_fr": "SQUID" }, "attack_vector": "squid probe \u00b7 via SQUID:3128 \u00b7 (sonde \/ probe)", "target_port_label": "3128 \u00b7 SQUID", "emulator_service": "squid", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab squid_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab squid_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 34\/100", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 34 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 34, "risk_label": "Faible", "service_name": "squid", "service_label_fr": "SQUID", "dst_port": 3128, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-squid", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 3128, "service": "squid", "service_label_fr": "SQUID" }, "attack_vector": "squid probe \u00b7 via SQUID:3128 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "3128 \u00b7 SQUID", "emulator_service": "squid", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "squid", "service_banner": "honeypot-squid", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "net_squid_probe", "squid_emulated" ] }
29/06/2026 23:41:42 UTC	TCP	2811 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 2811 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic YXNkYXNkOmFzZGFzZA== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.203961984697101, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 2811, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc", "event_fingerprint": "dadf7c41fc14bfcada768aa577c2eaa5bdae220c", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7a6ee4e26933983ab63147af17152685", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 2811, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YXNkYXNkOmFzZGFzZA==\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YXNkYXNkOmFzZGFzZA==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YXNkYXNkOmFzZGFzZA==", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YXNkYXNkOmFzZGFzZA==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YXNkYXNkOmFzZGFzZA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "077e1e1d0f6f325be48f4b93139aa0140af251a1", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YXNkYXNkOmFzZGFzZA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2811, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YXNkYXNkOmFzZGFzZA==", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:2811" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
29/06/2026 23:41:40 UTC	TCP	2811	—	Sonde port Sonde port · port 2811 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2811 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Ghosty Networks LLC", "service": null, "app_proto": null, "asn": 205759, "country": "US", "dst_port": 2811, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36", "event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 2811, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "target_port_label": "2811", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 2811, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "2811", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/06/2026 23:16:01 UTC	TCP	2811 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 2811 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic dGVhbToxMjM0NTY= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.124819680997173, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 2811, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc", "event_fingerprint": "dadf7c41fc14bfcada768aa577c2eaa5bdae220c", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6cebac4f1dddf081710bdea5e899f0c1", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 2811, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVhbToxMjM0NTY=\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVhbToxMjM0NTY=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVhbToxMjM0NTY=", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVhbToxMjM0NTY=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVhbToxMjM0NTY=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a1f66bf895029c34d237b9b968befaf58e722082", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVhbToxMjM0NTY=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2811, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVhbToxMjM0NTY=", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:2811" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
29/06/2026 23:15:59 UTC	TCP	2811	—	Sonde port Sonde port · port 2811 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2811 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Ghosty Networks LLC", "service": null, "app_proto": null, "asn": 205759, "country": "US", "dst_port": 2811, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36", "event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 2811, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "target_port_label": "2811", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 2811, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "2811", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/06/2026 20:42:21 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic dXNlcjoxMjM= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 5.092760226166685, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "099c69c96caa7fb46b23c5083e5bb268", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjoxMjM=\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjoxMjM=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjoxMjM=", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjoxMjM=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjoxMjM=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "eb9baaedf6621d9fc8b189dfa10e07dc887f0bcf", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjoxMjM=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjoxMjM=", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 20:40:46 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic YWRtaW46YmVhcg== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.132078214671821, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1542f39c02fcc436c87827ff3fe6a5c7", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YmVhcg==\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YmVhcg==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YmVhcg==", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YmVhcg==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YmVhcg==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1245e7e354cca7c0ccbef33ec49a978ab2501eec", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YmVhcg==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YmVhcg==", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 20:39:10 UTC	TCP	8501 · CONSUL WAN	consul-wan	consul probe consul probe · via CONSUL WAN:8501 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL-WAN WAF — Recommandation Surveiller Tags consul_wan_emulated net_consul_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8501 Chemin / cible — Service CONSUL WAN Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "consul-wan", "app_proto": "consul-wan", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 21, "tag_count": 2, "anomaly_count": 0, "campaign_key": "151ed377b83bdb0bf8dee7c8dc6bb82f47730ff1", "event_fingerprint": "ad3565c9d8d9e66dccf60b2f7165fdfd9f113de0", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul-wan", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8501, "service": "consul-wan", "service_name": "consul-wan", "risk_score": 21 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "741078ffdde56e8469dc12dc2fb83269ce1ce0b5", "protocol_details": { "port": 8501, "service": "consul-wan", "service_label_fr": "CONSUL WAN" }, "attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)", "target_port_label": "8501 \u00b7 CONSUL WAN", "emulator_service": "consul-wan", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul-wan", "service_label_fr": "CONSUL WAN", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul-wan", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 8501, "service": "consul-wan", "service_label_fr": "CONSUL WAN" }, "attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "8501 \u00b7 CONSUL WAN", "emulator_service": "consul-wan", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul_wan", "service_banner": "honeypot-consul-wan", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_wan_emulated", "net_consul_probe" ] }
29/06/2026 20:39:10 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic YWRtaW46d2lyZWxlc3M= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.219105244173024, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b6a2e50fae502703c5306b8330b2f417", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46d2lyZWxlc3M=\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46d2lyZWxlc3M=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46d2lyZWxlc3M=", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46d2lyZWxlc3M=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46d2lyZWxlc3M=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "af1259d87319cf73e321359bd0638f3b592ed974", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46d2lyZWxlc3M=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46d2lyZWxlc3M=", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 20:23:15 UTC	TCP	2811 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 2811 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic cm9vdDpKaTEyMzQ1Ng== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.208501105027406, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 2811, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc", "event_fingerprint": "dadf7c41fc14bfcada768aa577c2eaa5bdae220c", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bda44edee5e4834e61711979a6a10b5c", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 2811, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpKaTEyMzQ1Ng==\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpKaTEyMzQ1Ng==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpKaTEyMzQ1Ng==", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpKaTEyMzQ1Ng==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpKaTEyMzQ1Ng==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6fee9885bf2f1edbbf7d56cdcdde8f3c892ee11d", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpKaTEyMzQ1Ng==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2811, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpKaTEyMzQ1Ng==", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:2811" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
29/06/2026 20:23:14 UTC	TCP	2811	—	Sonde port Sonde port · port 2811 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2811 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Ghosty Networks LLC", "service": null, "app_proto": null, "asn": 205759, "country": "US", "dst_port": 2811, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36", "event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 2811, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "target_port_label": "2811", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 2811, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "2811", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/06/2026 17:27:53 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic dGs6dGs= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 96, "payload_entropy": 4.977100950110316, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5ea2f7d548dcf8d0d4272fb98e14969a", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGs6dGs=\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGs6dGs=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGs6dGs=", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGs6dGs=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGs6dGs=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0b430044898aa15fe696593280fa1f878a37eeec", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGs6dGs=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGs6dGs=", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 17:27:51 UTC	TCP	8501 · CONSUL WAN	consul-wan	consul probe consul probe · via CONSUL WAN:8501 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL-WAN WAF — Recommandation Surveiller Tags consul_wan_emulated net_consul_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8501 Chemin / cible — Service CONSUL WAN Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "consul-wan", "app_proto": "consul-wan", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 21, "tag_count": 2, "anomaly_count": 0, "campaign_key": "151ed377b83bdb0bf8dee7c8dc6bb82f47730ff1", "event_fingerprint": "ad3565c9d8d9e66dccf60b2f7165fdfd9f113de0", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul-wan", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8501, "service": "consul-wan", "service_name": "consul-wan", "risk_score": 21 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "741078ffdde56e8469dc12dc2fb83269ce1ce0b5", "protocol_details": { "port": 8501, "service": "consul-wan", "service_label_fr": "CONSUL WAN" }, "attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)", "target_port_label": "8501 \u00b7 CONSUL WAN", "emulator_service": "consul-wan", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul-wan", "service_label_fr": "CONSUL WAN", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul-wan", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 8501, "service": "consul-wan", "service_label_fr": "CONSUL WAN" }, "attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "8501 \u00b7 CONSUL WAN", "emulator_service": "consul-wan", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul_wan", "service_banner": "honeypot-consul-wan", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_wan_emulated", "net_consul_probe" ] }
29/06/2026 14:30:03 UTC	TCP	2811 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:2811 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 2811 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic MTIzOjEyMw== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 5.083954380954323, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 2811, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "dffd83c24187a57013606ed7ba844a97653111cc", "event_fingerprint": "dadf7c41fc14bfcada768aa577c2eaa5bdae220c", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0b3c7229dab6e4040ab364777377122d", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 2811, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzOjEyMw==", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzOjEyMw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "84d5d19bd1a5060bf5b8ec65651d3cb006e3f490", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzOjEyMw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2811, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 2811, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:2811 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MTIzOjEyMw==", "target_port_label": "2811 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:2811" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
29/06/2026 14:29:50 UTC	TCP	2811	—	Sonde port Sonde port · port 2811 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2811 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Ghosty Networks LLC", "service": null, "app_proto": null, "asn": 205759, "country": "US", "dst_port": 2811, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "96025864c06e1cfdff8d933a9397eeea944b3a36", "event_fingerprint": "09408073f1e92b7e2cdbca76c55fbf958bccd56b", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 2811, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "38303532fc3cfef7636f6f938f02a50c6117a9b2", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "target_port_label": "2811", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 2811, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 2811 }, "attack_vector": "Sonde port \u00b7 port 2811 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "2811", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "2811" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
29/06/2026 12:59:04 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 34, "payload_entropy": 4.0796786498829745, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ea4c1f14c0572be8ae54ef2dcba5f35", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "892b5fc7c13e0885d3a8c9b34ab054e61eafbf04", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 12:58:44 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 34, "payload_entropy": 4.0796786498829745, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ea4c1f14c0572be8ae54ef2dcba5f35", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "892b5fc7c13e0885d3a8c9b34ab054e61eafbf04", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 12:58:25 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic cm9vdDowMDAw Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 5.084212696443951, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d8e120fb14a41040c00cbe9bc8e1c8df", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDowMDAw\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDowMDAw\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDowMDAw", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDowMDAw\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDowMDAw", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "224e1e3c43d7315fb57bc5343b95f7bcf79b1ecf", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDowMDAw", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDowMDAw", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 12:58:05 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic dXNlcjphMTIzNDU2Nzg5 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.251603160879753, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5ff47dcec00ce5fff9c317b779462987", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjphMTIzNDU2Nzg5\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjphMTIzNDU2Nzg5\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjphMTIzNDU2Nzg5", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjphMTIzNDU2Nzg5\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjphMTIzNDU2Nzg5", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bcfababae8d5abf00fff9b5fb20b820676ab000d", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjphMTIzNDU2Nzg5", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjphMTIzNDU2Nzg5", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 12:57:45 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic YWRtaW46YXNkMTIz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.1128474454410515, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "264b2069863355b9191beca46cf72da8", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YXNkMTIz\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YXNkMTIz\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YXNkMTIz", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YXNkMTIz\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YXNkMTIz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "791307239972742b6f36eefb0cab9ef1214e0932", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YXNkMTIz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YXNkMTIz", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 12:57:25 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic cm9vdDptYWxheXNpYQ== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.251603160879754, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8eafebc8f32a680305107262c1e27b2f", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDptYWxheXNpYQ==\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDptYWxheXNpYQ==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDptYWxheXNpYQ==", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDptYWxheXNpYQ==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDptYWxheXNpYQ==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "085a0f3606440c3b648f3e45e685589e7c98dca2", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDptYWxheXNpYQ==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDptYWxheXNpYQ==", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 12:57:06 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic YWFhYmJiOmFhYWJiYg== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.1590105682871625, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eba9960e2cd337cb177ab6cefb3bd7db", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWFhYmJiOmFhYWJiYg==\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWFhYmJiOmFhYWJiYg==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWFhYmJiOmFhYWJiYg==", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWFhYmJiOmFhYWJiYg==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWFhYmJiOmFhYWJiYg==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "432ef6379848c015f08f32d3e4cba51e7623bd87", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWFhYmJiOmFhYWJiYg==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWFhYmJiOmFhYWJiYg==", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 12:56:46 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.1735272024952215, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2920c74a68a1a4aecba43c20d27ac7c1", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9829d254bd091707e144fdb22e36bb6bd3e27950", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 12:56:26 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic cm9vdDoxMjcyNDQ2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.14780390720451, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "cfe15355be0054de2de5cf3a205ac7a0", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDoxMjcyNDQ2\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDoxMjcyNDQ2\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDoxMjcyNDQ2", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDoxMjcyNDQ2\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDoxMjcyNDQ2", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5506f7e2147d096a33e792692307b2211f5383bf", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDoxMjcyNDQ2", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDoxMjcyNDQ2", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 12:56:06 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic b3BlcmF0b3I6b3BlcmF0b3I= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.147476994888548, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "281856395b9d30d8c4630e069d8430f6", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic b3BlcmF0b3I6b3BlcmF0b3I=\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic b3BlcmF0b3I6b3BlcmF0b3I=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic b3BlcmF0b3I6b3BlcmF0b3I=", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic b3BlcmF0b3I6b3BlcmF0b3I=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic b3BlcmF0b3I6b3BlcmF0b3I=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e4c7fc83a00ff05323ba707c293efa4a4e672dd6", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic b3BlcmF0b3I6b3BlcmF0b3I=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic b3BlcmF0b3I6b3BlcmF0b3I=", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 12:56:05 UTC	TCP	8501 · CONSUL WAN	consul-wan	consul probe consul probe · via CONSUL WAN:8501 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL-WAN WAF — Recommandation Surveiller Tags consul_wan_emulated net_consul_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8501 Chemin / cible — Service CONSUL WAN Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "consul-wan", "app_proto": "consul-wan", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 21, "tag_count": 2, "anomaly_count": 0, "campaign_key": "151ed377b83bdb0bf8dee7c8dc6bb82f47730ff1", "event_fingerprint": "ad3565c9d8d9e66dccf60b2f7165fdfd9f113de0", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul-wan", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8501, "service": "consul-wan", "service_name": "consul-wan", "risk_score": 21 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "741078ffdde56e8469dc12dc2fb83269ce1ce0b5", "protocol_details": { "port": 8501, "service": "consul-wan", "service_label_fr": "CONSUL WAN" }, "attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)", "target_port_label": "8501 \u00b7 CONSUL WAN", "emulator_service": "consul-wan", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul-wan", "service_label_fr": "CONSUL WAN", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul-wan", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 8501, "service": "consul-wan", "service_label_fr": "CONSUL WAN" }, "attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "8501 \u00b7 CONSUL WAN", "emulator_service": "consul-wan", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul_wan", "service_banner": "honeypot-consul-wan", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_wan_emulated", "net_consul_probe" ] }
29/06/2026 10:42:10 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 34, "payload_entropy": 4.0796786498829745, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ea4c1f14c0572be8ae54ef2dcba5f35", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "892b5fc7c13e0885d3a8c9b34ab054e61eafbf04", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 10:41:49 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic bWFuYWdlcjptYW5hZ2Vy Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.28502575786528, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a3f361efd5ca4ddca7d60b17cc1c60d8", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bWFuYWdlcjptYW5hZ2Vy\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bWFuYWdlcjptYW5hZ2Vy\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bWFuYWdlcjptYW5hZ2Vy", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bWFuYWdlcjptYW5hZ2Vy\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bWFuYWdlcjptYW5hZ2Vy", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d7896ab740ab48fd2186ec62fb92f9a9479c1e89", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bWFuYWdlcjptYW5hZ2Vy", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bWFuYWdlcjptYW5hZ2Vy", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 10:41:33 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.223656182171042, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "36fc113380f02038fafa08e52c191997", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ec399d31b113474677c27a43a9dcd11b9efb9aad", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 10:41:13 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic cm9vdDpwbHV0bw== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.171499998038263, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "28d204cb11793a7be7577aa4e35c0ce4", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpwbHV0bw==\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpwbHV0bw==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpwbHV0bw==", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpwbHV0bw==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpwbHV0bw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cec9690b126aa22eeda7df01ec81f317d11908ca", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpwbHV0bw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpwbHV0bw==", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 10:40:52 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 59, "payload_entropy": 4.210690457597532, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e17da1dfe5056ae954d421224c3320b4", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d0229fd9a8bf65d45821bb3cb0fd07d98e146bbb", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 10:40:30 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.177951705803785, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d5e908d9e5083611b77a268d30c1d71b", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4f45ac185a484c1727295f127ad723d2e7d86a72", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 10:40:07 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic MjIyMjI6MjIyMjI= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.035924368517974, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d25fb271b63e05a29e069a8a4fe090d5", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MjIyMjI6MjIyMjI=\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MjIyMjI6MjIyMjI=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MjIyMjI6MjIyMjI=", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MjIyMjI6MjIyMjI=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MjIyMjI6MjIyMjI=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4154390f56058dd085ecdbaf93b8fa7b7b8992dc", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MjIyMjI6MjIyMjI=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic MjIyMjI6MjIyMjI=", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 10:39:41 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic YWRtaW46YWExMjM0NTY= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.1019291142466034, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d911baf6debd83123c319646c11283a8", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWExMjM0NTY=\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWExMjM0NTY=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWExMjM0NTY=", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWExMjM0NTY=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWExMjM0NTY=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6611b61d0fe4c6a160f0b312100ec8ddf443cca9", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWExMjM0NTY=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46YWExMjM0NTY=", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 10:39:15 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic dnBuOjEyMzQ1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 5.057404160633786, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f8a9d3ce51fb2a1ce8ce7d30e1b263a7", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dnBuOjEyMzQ1\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dnBuOjEyMzQ1\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dnBuOjEyMzQ1", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dnBuOjEyMzQ1\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dnBuOjEyMzQ1", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c3a6855c35a29046c79daaf3538a2503c05381ac", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dnBuOjEyMzQ1", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dnBuOjEyMzQ1", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 10:38:47 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic cm9vdDpxd2VydHkhQDEyMw== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.3018248205832155, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "108de409349a69ab50f6d5240085b678", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHkhQDEyMw==\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHkhQDEyMw==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHkhQDEyMw==", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHkhQDEyMw==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHkhQDEyMw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f3c72c3588728e93017dec6ce06b12c5d984d8da", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHkhQDEyMw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDpxd2VydHkhQDEyMw==", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 10:38:17 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic cm9vdDptYXVyZWVuMQ== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.295629897010897, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "085f34be02368f14111e4079c545d59f", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDptYXVyZWVuMQ==\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDptYXVyZWVuMQ==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDptYXVyZWVuMQ==", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDptYXVyZWVuMQ==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDptYXVyZWVuMQ==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "64751417fd9c14edfb76763e2f0bb9d6e389295d", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDptYXVyZWVuMQ==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cm9vdDptYXVyZWVuMQ==", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 10:37:45 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic Z3Vlc3Q6MQ== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 5.12030910118832, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d4881e2331ac5c8e52bb32abc671bd5c", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MQ==\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MQ==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MQ==", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MQ==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MQ==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "01d269535f8971be3432c7e0bfed5101402880f8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MQ==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic Z3Vlc3Q6MQ==", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 10:37:12 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic YXBpOkFiY2QzMjEh Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.200534132736858, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "97182746156dc809eb3eace5ec793dfe", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YXBpOkFiY2QzMjEh\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YXBpOkFiY2QzMjEh\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YXBpOkFiY2QzMjEh", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YXBpOkFiY2QzMjEh\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YXBpOkFiY2QzMjEh", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5231a062519a5fc1397c0b6a6589bb16bae60511", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YXBpOkFiY2QzMjEh", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YXBpOkFiY2QzMjEh", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 10:37:10 UTC	TCP	8501 · CONSUL WAN	consul-wan	consul probe consul probe · via CONSUL WAN:8501 · (sonde / probe)	Élevée	Faible · 21
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CONSUL-WAN WAF — Recommandation Surveiller Tags consul_wan_emulated net_consul_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8501 Chemin / cible — Service CONSUL WAN Pourquoi cette classification : Type « consul_probe » (signaux protocolaires) · confiance 0% Confiance classification 0% Risque capteur Faible · 21 Confiance : Confiance 0 % — 2 signal(aux) capteur Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "port_inferred_service": true, "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "consul-wan", "app_proto": "consul-wan", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 21, "tag_count": 2, "anomaly_count": 0, "campaign_key": "151ed377b83bdb0bf8dee7c8dc6bb82f47730ff1", "event_fingerprint": "ad3565c9d8d9e66dccf60b2f7165fdfd9f113de0", "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "confidence": 0, "classification_confidence": 0, "precision_score": 0, "precision_signals": [], "kb_rule_ids": [], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 21 }, "named_classification_skipped": false, "service_name": "consul-wan", "risk_confidence_factor": 0, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "903d4a7efff645522f88fc15d7a1b2c2" }, "target_context": { "dst_port": 8501, "service": "consul-wan", "service_name": "consul-wan", "risk_score": 21 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "cloud_infra_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "741078ffdde56e8469dc12dc2fb83269ce1ce0b5", "protocol_details": { "port": 8501, "service": "consul-wan", "service_label_fr": "CONSUL WAN" }, "attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)", "target_port_label": "8501 \u00b7 CONSUL WAN", "emulator_service": "consul-wan", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "site_display": { "classification": null, "classification_reason": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "classification_reason_label_fr": "Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%", "executive_one_liner_fr": "Activit\u00e9 suspecte", "confidence_pct": 0, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 21 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 21, "risk_label": "Faible", "service_name": "consul-wan", "service_label_fr": "CONSUL WAN", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-consul-wan", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "port": 8501, "service": "consul-wan", "service_label_fr": "CONSUL WAN" }, "attack_vector": "consul probe \u00b7 via CONSUL WAN:8501 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "8501 \u00b7 CONSUL WAN", "emulator_service": "consul-wan", "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur", "confidence_factors_fr": null, "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "consul_wan", "service_banner": "honeypot-consul-wan", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "consul_wan_emulated", "net_consul_probe" ] }
29/06/2026 09:12:15 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic cHJveHk6MDAwMA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.151308983902591, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "699747c859fdc3b9271756579ef8f8c6", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cHJveHk6MDAwMA==\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cHJveHk6MDAwMA==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cHJveHk6MDAwMA==", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cHJveHk6MDAwMA==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cHJveHk6MDAwMA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "dc850c91a2ece01bd1d1d78c9cd59655d2ea3613", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cHJveHk6MDAwMA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic cHJveHk6MDAwMA==", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 09:12:01 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.177951705803785, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d5e908d9e5083611b77a268d30c1d71b", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4f45ac185a484c1727295f127ad723d2e7d86a72", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 09:11:47 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic dXNlcjpBYmNkMTIzNA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.240074341455341, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5e8884c0d5416df0f94eb94e20102fd5", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6a8b01999b7ae99f7572cd4b3652968844a01db4", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 09:11:31 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic bWFuYWdlcjpjaGFuZ2VtZQ== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.347533887357892, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a3f9031c1ea22f29f73941d566ae3360", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bWFuYWdlcjpjaGFuZ2VtZQ==\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bWFuYWdlcjpjaGFuZ2VtZQ==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bWFuYWdlcjpjaGFuZ2VtZQ==", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bWFuYWdlcjpjaGFuZ2VtZQ==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bWFuYWdlcjpjaGFuZ2VtZQ==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "044759f4f02e05128d439508511c937869b677a7", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bWFuYWdlcjpjaGFuZ2VtZQ==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic bWFuYWdlcjpjaGFuZ2VtZQ==", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }
29/06/2026 09:11:15 UTC	TCP	8501 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8501 · (sonde / probe) · → 64.89.161.90:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.90:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.161.90:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8501 Chemin / cible 64.89.161.90:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 85% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.90:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.90:80 HTTP/1.0 Host: 64.89.161.90:80 Proxy-Authorization: Basic YWRtaW46MDAwMA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "90:80", "http_ua_hash": null, "http_host_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_target_hash": "6c1fa83ea19bd3fab99af4e3e43b893b3e31a259", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.124819680997172, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 8501, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.5, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "06d7e1033426ed44ca10d8cc3ec258bc04026217", "event_fingerprint": "9a74fafa671caf0cac2415f9862b3115e1e0ca24", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d059c596799bdca23319d99eb51e9da4", "path_pattern_hash": "b362db6993494feb111a2e5f8fd9defa" }, "service_name": "http", "target_context": { "dst_port": 8501, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46MDAwMA==\r\n\r\n", "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46MDAwMA==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46MDAwMA==", "evidence": { "method": "CONNECT", "path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46MDAwMA==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46MDAwMA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.85, "classification_confidence": 0.85, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "838d8c3ff65fdd380b248dfe5507c726c6c0e98b", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46MDAwMA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 85, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8501, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.90:80", "request_line": "CONNECT 64.89.161.90:80 HTTP\/1.1", "port": 8501, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8501 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.90:80", "evidence_snippet": "CONNECT 64.89.161.90:80 HTTP\/1.0\r\nHost: 64.89.161.90:80\r\nProxy-Authorization: Basic YWRtaW46MDAwMA==", "target_port_label": "8501 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8501" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "consul-wan", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ] }

64.89.161.90

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence