Détails IP 64.89.161.93

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « web_probe » (signaux protocolaires) · confiance 77%

Confiance 77 % — Score WAF 8

Comparaison ASN / FAI

ASN 205759 · 64.89.161.0/24 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 258 événements sur la période pour cette IP.

43.228.157.152 Sonde port 5900/TCP 24/07/2026 19:34 UTC
43.228.157.211 Sonde port 5900/TCP 24/07/2026 19:27 UTC
43.228.157.180 Sonde port 5900/TCP 24/07/2026 19:17 UTC
64.89.160.111 Sonde HTTP 24/07/2026 18:58 UTC
43.228.157.82 Sonde port 5900/TCP 24/07/2026 18:48 UTC
43.228.157.155 Sonde port 5900/TCP 24/07/2026 18:48 UTC
43.228.157.17 Sonde port 5900/TCP 24/07/2026 18:08 UTC
43.228.157.183 Sonde port 5900/TCP 24/07/2026 17:57 UTC

IPs apparentées

Même FAI Ghosty Networks LLC — corrélation indicative.

43.228.157.152 Sonde port 5900/TCP
43.228.157.211 Sonde port 5900/TCP
43.228.157.180 Sonde port 5900/TCP
64.89.160.111 Sonde HTTP
43.228.157.82 Sonde port 5900/TCP

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 100 HDFS NAMENODE TCP 21 SSH TCP 11 SOCKS5 TCP 6 MEMCACHED ALT TCP 4

HTTP

100

HDFS NAMENODE

21

SSH

11

SOCKS5

6

MEMCACHED ALT

4

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

258 événement(s) — page 6/6

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
11/07/2026 05:34:18 UTC	TCP	20648 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:20648 · (sonde / probe) · → 64.89.161.93:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.93:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.161.93:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 20648 Chemin / cible 64.89.161.93:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.93:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.93:80 HTTP/1.0 Host: 64.89.161.93:80 Proxy-Authorization: Basic dXNlcjE6cGFzczE= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "93:80", "http_ua_hash": null, "http_host_hash": "0a7f99ded8cdab53e2685c72a8cd85b425e3f6c0", "http_target_hash": "0a7f99ded8cdab53e2685c72a8cd85b425e3f6c0", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 102, "payload_entropy": 5.1697352106265475, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 20648, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d15fafcc0cacbad2fa9e951201ab679abbf53c8e", "event_fingerprint": "2e3cda6f335cad99e3660a95ad3e7133e29ca940", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e8f76080b019fe68a0ae1839a16924ff", "path_pattern_hash": "fd099add8675a332ffad36e3afb7fc8e" }, "service_name": "http", "target_context": { "dst_port": 20648, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n", "method": "CONNECT", "path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n", "payload_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "evidence": { "method": "CONNECT", "path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n", "payload_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "badc8a57dd0a254ce2637ed8fda5dd94d7e1e007", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "port": 20648, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.93:80", "target_port_label": "20648 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 20648, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "port": 20648, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.93:80", "evidence_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=", "target_port_label": "20648 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "20648" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
11/07/2026 05:34:05 UTC	TCP	20648 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:20648 · (sonde / probe) · → 64.89.161.93:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.93:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.161.93:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 20648 Chemin / cible 64.89.161.93:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.93:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.93:80 HTTP/1.0 Host: 64.89.161.93:80 Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "93:80", "http_ua_hash": null, "http_host_hash": "0a7f99ded8cdab53e2685c72a8cd85b425e3f6c0", "http_target_hash": "0a7f99ded8cdab53e2685c72a8cd85b425e3f6c0", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.187595988552018, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 20648, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d15fafcc0cacbad2fa9e951201ab679abbf53c8e", "event_fingerprint": "2e3cda6f335cad99e3660a95ad3e7133e29ca940", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "41a16f8cd2e3a0ab0ae1c2fe157811bf", "path_pattern_hash": "fd099add8675a332ffad36e3afb7fc8e" }, "service_name": "http", "target_context": { "dst_port": 20648, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n", "method": "CONNECT", "path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n", "payload_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "evidence": { "method": "CONNECT", "path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n", "payload_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5506db5ded77fe159b824d587d278295e2437592", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "port": 20648, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.93:80", "target_port_label": "20648 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 20648, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "port": 20648, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.93:80", "evidence_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "target_port_label": "20648 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "20648" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
11/07/2026 05:34:05 UTC	TCP	20648 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:20648 · (sonde / probe) · → 64.89.161.93:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.93:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.161.93:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 20648 Chemin / cible 64.89.161.93:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.93:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.93:80 HTTP/1.0 Host: 64.89.161.93:80 Proxy-Authorization: Basic bm9kZToxcWF6MndzeA== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "93:80", "http_ua_hash": null, "http_host_hash": "0a7f99ded8cdab53e2685c72a8cd85b425e3f6c0", "http_target_hash": "0a7f99ded8cdab53e2685c72a8cd85b425e3f6c0", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.255217600931265, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 20648, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.4, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d15fafcc0cacbad2fa9e951201ab679abbf53c8e", "event_fingerprint": "2e3cda6f335cad99e3660a95ad3e7133e29ca940", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d008897812bb24aa03e52816ad6ca881", "path_pattern_hash": "fd099add8675a332ffad36e3afb7fc8e" }, "service_name": "http", "target_context": { "dst_port": 20648, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic bm9kZToxcWF6MndzeA==\r\n\r\n", "method": "CONNECT", "path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic bm9kZToxcWF6MndzeA==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic bm9kZToxcWF6MndzeA==", "evidence": { "method": "CONNECT", "path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic bm9kZToxcWF6MndzeA==\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic bm9kZToxcWF6MndzeA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f9082175b91872e9a5203641c342be9fa6ac893f", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "port": 20648, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic bm9kZToxcWF6MndzeA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.93:80", "target_port_label": "20648 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 20648, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "port": 20648, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:20648 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.93:80", "evidence_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic bm9kZToxcWF6MndzeA==", "target_port_label": "20648 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "20648" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
06/07/2026 07:31:02 UTC	TCP	31888 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:31888 · (sonde / probe) · → 64.89.161.93:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.93:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.161.93:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 31888 Chemin / cible 64.89.161.93:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.93:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.93:80 HTTP/1.0 Host: 64.89.161.93:80 Proxy-Authorization: Basic cm9vdDo4ODg4ODg= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "93:80", "http_ua_hash": null, "http_host_hash": "0a7f99ded8cdab53e2685c72a8cd85b425e3f6c0", "http_target_hash": "0a7f99ded8cdab53e2685c72a8cd85b425e3f6c0", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.1367919165532925, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 31888, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "b8097952c1a83ccc0b25c54c115ed96478937fa9", "event_fingerprint": "ddc76847601e9bc74c87fc1742c4453b2310b6a4", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c4b7f20e6a5c691377e981878e3f903e", "path_pattern_hash": "fd099add8675a332ffad36e3afb7fc8e" }, "service_name": "http", "target_context": { "dst_port": 31888, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDo4ODg4ODg=\r\n\r\n", "method": "CONNECT", "path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDo4ODg4ODg=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDo4ODg4ODg=", "evidence": { "method": "CONNECT", "path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDo4ODg4ODg=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDo4ODg4ODg=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "eb4297d2c4ce423f3854a7aee33563e80d3c34dd", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "port": 31888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDo4ODg4ODg=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:31888 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.93:80", "target_port_label": "31888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 31888, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "port": 31888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:31888 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.93:80", "evidence_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDo4ODg4ODg=", "target_port_label": "31888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "31888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
06/07/2026 07:31:02 UTC	TCP	31888 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:31888 · (sonde / probe) · → 64.89.161.93:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.93:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.161.93:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 31888 Chemin / cible 64.89.161.93:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.93:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.93:80 HTTP/1.0 Host: 64.89.161.93:80 Proxy-Authorization: Basic cm9vdDo4ODg4ODg= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "93:80", "http_ua_hash": null, "http_host_hash": "0a7f99ded8cdab53e2685c72a8cd85b425e3f6c0", "http_target_hash": "0a7f99ded8cdab53e2685c72a8cd85b425e3f6c0", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.1367919165532925, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 31888, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "b8097952c1a83ccc0b25c54c115ed96478937fa9", "event_fingerprint": "ddc76847601e9bc74c87fc1742c4453b2310b6a4", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c4b7f20e6a5c691377e981878e3f903e", "path_pattern_hash": "fd099add8675a332ffad36e3afb7fc8e" }, "service_name": "http", "target_context": { "dst_port": 31888, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDo4ODg4ODg=\r\n\r\n", "method": "CONNECT", "path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDo4ODg4ODg=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDo4ODg4ODg=", "evidence": { "method": "CONNECT", "path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDo4ODg4ODg=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDo4ODg4ODg=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "eb4297d2c4ce423f3854a7aee33563e80d3c34dd", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "port": 31888, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDo4ODg4ODg=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:31888 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.93:80", "target_port_label": "31888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 31888, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "port": 31888, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:31888 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.93:80", "evidence_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDo4ODg4ODg=", "target_port_label": "31888 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "31888" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
05/07/2026 09:11:43 UTC	TCP	21323 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 64.89.161.93:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.93:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.161.93:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 21323 Chemin / cible 64.89.161.93:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.93:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.93:80 HTTP/1.0 Host: 64.89.161.93:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "93:80", "http_ua_hash": null, "http_host_hash": "0a7f99ded8cdab53e2685c72a8cd85b425e3f6c0", "http_target_hash": "0a7f99ded8cdab53e2685c72a8cd85b425e3f6c0", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.062413671423392, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 21323, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e", "event_fingerprint": "3baf9df0ba1be0eae56e634b20964e900c873eb3", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "21af0052437fc24b635d24b4818bdee5", "path_pattern_hash": "fd099add8675a332ffad36e3afb7fc8e" }, "service_name": "http", "target_context": { "dst_port": 21323, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "method": "CONNECT", "path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "evidence": { "method": "CONNECT", "path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9c4badabecb9ebb23b62dc832fc8705a98097cdf", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "port": 21323, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.93:80", "target_port_label": "21323 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 21323, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "port": 21323, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.93:80", "evidence_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "target_port_label": "21323 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "21323" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
05/07/2026 09:06:14 UTC	TCP	21323 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 64.89.161.93:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.93:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.161.93:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 21323 Chemin / cible 64.89.161.93:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.93:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.93:80 HTTP/1.0 Host: 64.89.161.93:80 Proxy-Authorization: Basic cm9vdDoxMTIyMzNxcQ== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "93:80", "http_ua_hash": null, "http_host_hash": "0a7f99ded8cdab53e2685c72a8cd85b425e3f6c0", "http_target_hash": "0a7f99ded8cdab53e2685c72a8cd85b425e3f6c0", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.217268130323023, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 21323, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e", "event_fingerprint": "3baf9df0ba1be0eae56e634b20964e900c873eb3", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "9c77cfe2317128fd4a0974e3f20593af", "path_pattern_hash": "fd099add8675a332ffad36e3afb7fc8e" }, "service_name": "http", "target_context": { "dst_port": 21323, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDoxMTIyMzNxcQ==\r\n", "method": "CONNECT", "path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDoxMTIyMzNxcQ==\r\n", "payload_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDoxMTIyMzNxcQ==", "evidence": { "method": "CONNECT", "path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDoxMTIyMzNxcQ==\r\n", "payload_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDoxMTIyMzNxcQ==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "941305e8cded593a39d7e6ebe237f9bee248be8e", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "port": 21323, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDoxMTIyMzNxcQ==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.93:80", "target_port_label": "21323 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 21323, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "port": 21323, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.93:80", "evidence_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic cm9vdDoxMTIyMzNxcQ==", "target_port_label": "21323 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "21323" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }
05/07/2026 09:01:02 UTC	TCP	21323 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:21323 · (sonde / probe) · → 64.89.161.93:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.161.93:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.161.93:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 21323 Chemin / cible 64.89.161.93:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.161.93:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.161.93:80 HTTP/1.0 Host: 64.89.161.93:80 Proxy-Authorization: Basic dXNlcjo5OTk5OTk= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "93:80", "http_ua_hash": null, "http_host_hash": "0a7f99ded8cdab53e2685c72a8cd85b425e3f6c0", "http_target_hash": "0a7f99ded8cdab53e2685c72a8cd85b425e3f6c0", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 102, "payload_entropy": 5.168756137390176, "port_category": "registered", "org": "Ghosty Networks LLC", "service": "http", "app_proto": "http", "asn": 205759, "country": "US", "dst_port": 21323, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "8109f99f46af7d42b25ef24dac043d944579ac6e", "event_fingerprint": "3baf9df0ba1be0eae56e634b20964e900c873eb3", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 205759, "org": "Ghosty Networks LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "80d54e2e3b9e02753742bbe9f4763b8d", "path_pattern_hash": "fd099add8675a332ffad36e3afb7fc8e" }, "service_name": "http", "target_context": { "dst_port": 21323, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dXNlcjo5OTk5OTk=\r\n", "method": "CONNECT", "path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dXNlcjo5OTk5OTk=\r\n", "payload_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dXNlcjo5OTk5OTk=", "evidence": { "method": "CONNECT", "path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dXNlcjo5OTk5OTk=\r\n", "payload_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dXNlcjo5OTk5OTk=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fc272790bab034d6f0d91ccbac62591f34225210", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "port": 21323, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dXNlcjo5OTk5OTk=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.93:80", "target_port_label": "21323 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 21323, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.161.93:80", "request_line": "CONNECT 64.89.161.93:80 HTTP\/1.1", "port": 21323, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:21323 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.161.93:80", "evidence_snippet": "CONNECT 64.89.161.93:80 HTTP\/1.0\r\nHost: 64.89.161.93:80\r\nProxy-Authorization: Basic dXNlcjo5OTk5OTk=", "target_port_label": "21323 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "21323" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ] }

Réputation

Sécurité avancée

Offensive / Recon

Sécurité

DNS

Réseau

E-mail

IP

Utilitaires

64.89.161.93

Profil de menace

Pourquoi listée

Comparaison ASN / FAI

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence