|
|
TCP |
8889 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8889
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic cm9vdDpaejEyMzQ1Njc4OQ==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 114,
"payload_entropy": 5.27210566829423,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8889,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
"event_fingerprint": "b87868d530090be65507d0f9ba790c05144b949b",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fcf5e23179d06067e8b79350af82d187",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8889,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpaejEyMzQ1Njc4OQ==\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpaejEyMzQ1Njc4OQ==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpaejEyMzQ1Njc4OQ==",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpaejEyMzQ1Njc4OQ==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpaejEyMzQ1Njc4OQ==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cf5681e0c57af1c40d398bacf37c3a860ef96f41",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpaejEyMzQ1Njc4OQ==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpaejEyMzQ1Njc4OQ==",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8889 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8889 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8889
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic cm9vdDpQYXNzd29yZEAx
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 110,
"payload_entropy": 5.245815482428435,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8889,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
"event_fingerprint": "b87868d530090be65507d0f9ba790c05144b949b",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "01dbf8b6ef46d107aa76232c1c0b7701",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8889,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzd29yZEAx\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzd29yZEAx\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzd29yZEAx",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzd29yZEAx\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzd29yZEAx",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7aa18314a38f1463706c193ad2d29349ce3f99a9",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzd29yZEAx",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8889,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8889,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpQYXNzd29yZEAx",
"target_port_label": "8889 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8889"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 64.89.162.146:80 HTTP/1.0 Host: 64.89.162.146:80 Proxy-Authorization: Basic dWJ1bnR1OnN1cGVy
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic dWJ1bnR1OnN1cGVy
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 106,
"payload_entropy": 5.130748521108971,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "https",
"app_proto": "https",
"asn": 198584,
"country": "US",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4cfc15c67da9b5cf6c969aefee63020c",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dWJ1bnR1OnN1cGVy\r\n\r\n",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dWJ1bnR1OnN1cGVy\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dWJ1bnR1OnN1cGVy",
"evidence": {
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dWJ1bnR1OnN1cGVy\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dWJ1bnR1OnN1cGVy",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2067074db62ece538be955bf7c78e657ea7ad59",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dWJ1bnR1OnN1cGVy",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dWJ1bnR1OnN1cGVy",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dWJ1bnR1OnN1cGVy",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dWJ1bnR1OnN1cGVy",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 64.89.162.146:80 HTTP/1.0 Host: 64.89.162.146:80 Proxy-Authorization: Basic MTox
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic MTox
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 92,
"payload_entropy": 4.939163930047689,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "https",
"app_proto": "https",
"asn": 198584,
"country": "US",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2cd420705eac6a959f614fad6050d9f8",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTox\r\n",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTox\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTox",
"evidence": {
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTox\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTox",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0511ee6d7b4e1edb41e2efb968cb3668ba027256",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTox",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTox",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTox",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTox",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 64.89.162.146:80 HTTP/1.0 Host: 64.89.162.146:80 Proxy-Authorization: Basic cm9vdDpwYXNz
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic cm9vdDpwYXNz
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 100,
"payload_entropy": 5.179659785525614,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "https",
"app_proto": "https",
"asn": 198584,
"country": "US",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "127a394aefb9dd7ab4551e117a35041d",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpwYXNz\r\n",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpwYXNz\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpwYXNz",
"evidence": {
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpwYXNz\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpwYXNz",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "694600302d1bd05cdee54454ebbee435948dcbf9",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpwYXNz",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpwYXNz",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpwYXNz",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpwYXNz",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 64.89.162.146:80 HTTP/1.0 Host: 64.89.162.146:80 Proxy-Authorization: Basic ZGV2dGVzdDpkZXZ0ZXN0
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic ZGV2dGVzdDpkZXZ0ZXN0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 108,
"payload_entropy": 5.206050526263607,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "https",
"app_proto": "https",
"asn": 198584,
"country": "US",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "baab6470ddc76bde6b43d4f5ae620d9e",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ZGV2dGVzdDpkZXZ0ZXN0\r\n",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ZGV2dGVzdDpkZXZ0ZXN0\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ZGV2dGVzdDpkZXZ0ZXN0",
"evidence": {
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ZGV2dGVzdDpkZXZ0ZXN0\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ZGV2dGVzdDpkZXZ0ZXN0",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d70b0d1f0cb37b615b59e95574ae77f4fb9c04f5",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ZGV2dGVzdDpkZXZ0ZXN0",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ZGV2dGVzdDpkZXZ0ZXN0",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ZGV2dGVzdDpkZXZ0ZXN0",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ZGV2dGVzdDpkZXZ0ZXN0",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 64.89.162.146:80 HTTP/1.0 Host: 64.89.162.146:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 104,
"payload_entropy": 5.0329771907635825,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "https",
"app_proto": "https",
"asn": 198584,
"country": "US",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "23a5659f4bdb5a89f5676e476fad46db",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"evidence": {
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "76a5fe073282fcd3af31e6044cbc8a035e87068c",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 64.89.162.146:80 HTTP/1.0 Host: 64.89.162.146:80 Proxy-Authorization: Basic bGl1eWFuZzphZG1pbjE=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ET wfuzz
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic bGl1eWFuZzphZG1pbjE=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 108,
"payload_entropy": 5.2645938966028085,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "https",
"app_proto": "https",
"asn": 198584,
"country": "US",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0813",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ET wfuzz",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0813",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9a29e74f3f5e8e582ad5274aa05bc1d6",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bGl1eWFuZzphZG1pbjE=\r\n",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bGl1eWFuZzphZG1pbjE=\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bGl1eWFuZzphZG1pbjE=",
"evidence": {
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bGl1eWFuZzphZG1pbjE=\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bGl1eWFuZzphZG1pbjE=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "420cab14708e1f678e20fcdf916c8a795f7427d5",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bGl1eWFuZzphZG1pbjE=",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bGl1eWFuZzphZG1pbjE=",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bGl1eWFuZzphZG1pbjE=",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bGl1eWFuZzphZG1pbjE=",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 64.89.162.146:80 HTTP/1.0 Host: 64.89.162.146:80 Proxy-Authorization: Basic bnZpZGlhOm52aWRpYQ==
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic bnZpZGlhOm52aWRpYQ==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 108,
"payload_entropy": 5.325076016747618,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "https",
"app_proto": "https",
"asn": 198584,
"country": "US",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "88064f7457e5a4f5a46a42da42f00651",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bnZpZGlhOm52aWRpYQ==\r\n",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bnZpZGlhOm52aWRpYQ==\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bnZpZGlhOm52aWRpYQ==",
"evidence": {
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bnZpZGlhOm52aWRpYQ==\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bnZpZGlhOm52aWRpYQ==",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4746d12ad2fa6f253d35a4a1a63ea6b9a641e013",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bnZpZGlhOm52aWRpYQ==",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bnZpZGlhOm52aWRpYQ==",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bnZpZGlhOm52aWRpYQ==",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bnZpZGlhOm52aWRpYQ==",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 64.89.162.146:80 HTTP/1.0 Host: 64.89.162.146:80 Proxy-Authorization: Basic cm9vdDpyb290
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic cm9vdDpyb290
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 102,
"payload_entropy": 5.109679357498383,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "https",
"app_proto": "https",
"asn": 198584,
"country": "US",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "881c6ff33b18fd384cae04f35b3618dc",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n\r\n",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"evidence": {
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c906ffd5f35e3ad1b61a8c7febd244b28723a41e",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
9443 · HTTPS
|
https
|
Flood / DDoS
http flood · via HTTPS:9443 · (tentative d'exploit)
|
Élevée
|
Moyen · 46
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
Émulateur
HTTPS
WAF
—
Recommandation
Surveiller
Tags
http_alt_port
net_web_probe
websphere_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
9443
Chemin / cible
—
Service
HTTPS
Payload
CONNECT 64.89.162.146:80 HTTP/1.0 Host: 64.89.162.146:80 Proxy-Authorization: Basic dXNlcjoxMjM0NTY=
Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49%
Confiance classification
49%
Confiance modérée — signal unique
Risque capteur
Moyen
· 46
Confiance : Confiance 49 % — Motif catalogue confirmé
Protocole émulé
1
Signaux
pat-0418
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
Cred Basic auth spray
HTTP CONNECT method
ActiveMQ STOMP
Squid HTTP proxy
HTTPS alt 9443 probe
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic dXNlcjoxMjM0NTY=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"bytes_in": 104,
"payload_entropy": 5.152269228807493,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "https",
"app_proto": "https",
"asn": 198584,
"country": "US",
"dst_port": 9443,
"risk_waf": 8,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15
},
"risk_score": 46,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
"event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"confidence": 0.49,
"classification_confidence": 0.49,
"precision_score": 58,
"precision_signals": [
"pat-0418"
],
"kb_rule_ids": [
"pat-0418"
],
"matched_patterns": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"matched_pattern_names": [
"Cred Basic auth spray",
"HTTP CONNECT method",
"ActiveMQ STOMP",
"Squid HTTP proxy",
"HTTPS alt 9443 probe"
],
"pattern_ids": [
"pat-0463",
"pat-0418",
"pat-0559",
"pat-0568",
"pat-0600"
],
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"named_classification_skipped": false,
"service_name": "https",
"risk_confidence_factor": 49,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b4fb1b82057ba1dfcd1b0c80c08c6cc2",
"path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
},
"target_context": {
"dst_port": 9443,
"service": "https",
"service_name": "https",
"risk_score": 46
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NTY=\r\n",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NTY=\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NTY=",
"evidence": {
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NTY=\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NTY=",
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"ddos"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fc0b393a32a99e1191197829e8c08f6c16eec754",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NTY=",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NTY=",
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
"confidence_pct": 49,
"confidence_breakdown": {
"waf": 8,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 15,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "https",
"service_label_fr": "HTTPS",
"dst_port": 9443,
"protocol_emulated": true,
"tags_summary": [
"pat-0418"
],
"tags_summary_labels_fr": [
"pat-0418"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-https",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NTY=",
"port": 9443,
"service": "https",
"service_label_fr": "HTTPS"
},
"attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjoxMjM0NTY=",
"target_port_label": "9443 \u00b7 HTTPS",
"emulator_service": "https",
"confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "https",
"service_banner": "honeypot-https",
"service_os": "linux",
"dst_port": "9443"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_port",
"net_web_probe",
"websphere_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5122 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:5122 · (sonde / probe) · → 1.1.1.1:443
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 1.1.1.1:443
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
1.1.1.1:443
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
5122
Chemin / cible
1.1.1.1:443
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
82%
Corrélation +8
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 1.1.1.1:443 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 1.1.1.1:443 HTTP/1.0
Host: 1.1.1.1
Meta JSON brut
{
"http_header_count": 1,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "1:443",
"http_ua_hash": null,
"http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
"http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 47,
"payload_entropy": 3.912028011761936,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 5122,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 2.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "c18209927506ee0a3f384f529085666c3645a883",
"event_fingerprint": "c28fbcdc4d8de2db4e93eaabdfcfb73cdef2f814",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
"path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
},
"service_name": "http",
"target_context": {
"dst_port": 5122,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"method": "CONNECT",
"path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"evidence": {
"method": "CONNECT",
"path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
"payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.82,
"classification_confidence": 0.82,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f3dc708aa1221aa78bdd10c81be7140ef75b2142",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"port": 5122,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5122 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
"target_port_label": "5122 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 82,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 0,
"risk_score": 40,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5122,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "1.1.1.1:443",
"request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
"port": 5122,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:5122 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
"evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
"target_port_label": "5122 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5122"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"port:5122"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5122
|
—
|
Sonde port
Sonde port · port 5122 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5122
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance 50 % — Motif catalogue confirmé
Signaux
pat-0554
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 4,
"payload_entropy": 1.5,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": null,
"app_proto": null,
"asn": 198584,
"country": "US",
"dst_port": 5122,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "cc5e90ff7cdb46632d465dfc26a2498f08b31caa",
"event_fingerprint": "533949127304399d0d39d1a89ba6438beb399f28",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"pat-0554"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5122,
"risk_score": 44
},
"payload_preview": "\u0005\u0002\u0000\u0002",
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"evidence": {
"request_sample": "\u0005\u0002\u0000\u0002",
"payload_snippet": "\u0005\u0002\u0000\u0002",
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "42b1fe09f3a7832bb2d501d87b72f24a02029b4b",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 5122
},
"attack_vector": "Sonde port \u00b7 port 5122 \u00b7 (sonde \/ probe)",
"target_port_label": "5122",
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 5122,
"protocol_emulated": null,
"tags_summary": [
"pat-0554"
],
"tags_summary_labels_fr": [
"pat-0554"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"payload_preview": "\u0005\u0002\u0000\u0002",
"port": 5122
},
"attack_vector": "Sonde port \u00b7 port 5122 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5122",
"emulator_service": null,
"confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5122"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
5122
|
—
|
proxy probe
proxy probe · port 5122 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
socks4_greeting
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5122
Chemin / cible
—
Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 0%
Confiance classification
0%
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 9,
"payload_entropy": 1.4466166676282082,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": null,
"app_proto": null,
"asn": 198584,
"country": "US",
"dst_port": 5122,
"risk_waf": 8,
"risk_classification": 32,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.5,
"risk_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 24,
"tag_count": 1,
"anomaly_count": 0,
"campaign_key": "dbe78363c05b0418697697c3d793c094e4c956b3",
"event_fingerprint": "36a05e7ca7022d4fdb5c43f15562a66da63a3a49",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"confidence": 0,
"classification_confidence": 0,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 24
},
"named_classification_skipped": false,
"risk_confidence_factor": 0,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
"path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
},
"target_context": {
"dst_port": 5122,
"risk_score": 24
},
"payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"evidence": {
"request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c74ead22c2ee253996c8573d194ec84ec3821826",
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"port": 5122
},
"evidence_snippet": "\ufffd",
"attack_vector": "proxy probe \u00b7 port 5122 \u00b7 (sonde \/ probe)",
"target_port_label": "5122",
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
"executive_one_liner_fr": "Activit\u00e9 suspecte",
"confidence_pct": 0,
"confidence_breakdown": {
"waf": 8,
"classification": 32,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 24
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 24,
"risk_label": "Faible",
"service_name": null,
"service_label_fr": null,
"dst_port": 5122,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
"port": 5122
},
"attack_vector": "proxy probe \u00b7 port 5122 \u00b7 (sonde \/ probe)",
"evidence_snippet": "\ufffd",
"target_port_label": "5122",
"emulator_service": null,
"confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
"confidence_factors_fr": null,
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5122"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"socks4_greeting"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5122
|
—
|
Sonde port
Sonde port · port 5122 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
5122
Chemin / cible
—
Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": null,
"app_proto": null,
"asn": 198584,
"country": "US",
"dst_port": 5122,
"risk_waf": 8,
"risk_classification": 48,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 1.1,
"risk_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0
},
"risk_score": 44,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "cc5e90ff7cdb46632d465dfc26a2498f08b31caa",
"event_fingerprint": "533949127304399d0d39d1a89ba6438beb399f28",
"classification_confidence": 0.5,
"confidence": 0.5,
"precision_signals": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
},
"target_context": {
"dst_port": 5122,
"risk_score": 44
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "de7f355624a56699a18944bc3531bb91611292bd",
"protocol_details": {
"port": 5122
},
"attack_vector": "Sonde port \u00b7 port 5122 \u00b7 (sonde \/ probe)",
"target_port_label": "5122",
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 8,
"classification": 48,
"behavior": 0,
"geo": 40,
"protocol": 0,
"novelty": 0,
"risk_score": 44
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 44,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 5122,
"protocol_emulated": null,
"tags_summary": [
"INT-FP-port-probe-noise",
"INT-single-port"
],
"tags_summary_labels_fr": [
"Fp Port Probe Noise",
"Single Port"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"port": 5122
},
"attack_vector": "Sonde port \u00b7 port 5122 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "5122",
"emulator_service": null,
"confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "5122"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTP
WAF
—
Recommandation
Surveiller
Tags
http_alt_8080
http_alt_port
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8080
Chemin / cible
—
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "986800c5ad65e75d541a277e48953dacf3f318da",
"event_fingerprint": "5afc6680f618e490dc22cb875ac6d45b5c7d65ea",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "945d6c54aac35f31bab6fba8d81332256826a36c",
"protocol_details": {
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_8080",
"http_alt_port",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic MTIzOjEyMw==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 5.117080215362731,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "12d68dff3645c0b30d170fc60026f302",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTIzOjEyMw==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9f3a65d7c60fffe6f4ca30787f7bb138f7ff31f6",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTIzOjEyMw==",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe)
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
HTTP
WAF
—
Recommandation
Surveiller
Tags
http_alt_8080
http_alt_port
net_web_probe
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8080
Chemin / cible
—
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 33,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.2,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 0
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "986800c5ad65e75d541a277e48953dacf3f318da",
"event_fingerprint": "5afc6680f618e490dc22cb875ac6d45b5c7d65ea",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "945d6c54aac35f31bab6fba8d81332256826a36c",
"protocol_details": {
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 33,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_alt_8080",
"http_alt_port",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic cm9vdDpQQVNTVzBSRCQxMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 112,
"payload_entropy": 5.332582351280147,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "1d52abb83a5bd596984c86d7ad0b440e",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpQQVNTVzBSRCQxMjM=\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpQQVNTVzBSRCQxMjM=\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpQQVNTVzBSRCQxMjM=",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpQQVNTVzBSRCQxMjM=\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpQQVNTVzBSRCQxMjM=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2201fad5d2c86d28136a84fdabf92a8bb114ab48",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpQQVNTVzBSRCQxMjM=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpQQVNTVzBSRCQxMjM=",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic cm9vdDpBZG1pbkAxMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 110,
"payload_entropy": 5.308131418540012,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "909a533ed30684ff38fa8a0ce12014e4",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpBZG1pbkAxMjM=\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpBZG1pbkAxMjM=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpBZG1pbkAxMjM=",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpBZG1pbkAxMjM=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpBZG1pbkAxMjM=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "af96b08af134614d076d12d5e37e26ff01dc91e2",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpBZG1pbkAxMjM=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpBZG1pbkAxMjM=",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic cm9vdDpDb3dib3lzQDEyMw==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 114,
"payload_entropy": 5.340302488564557,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2a89bbce779c114a9bef68ef3049254f",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpDb3dib3lzQDEyMw==\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpDb3dib3lzQDEyMw==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpDb3dib3lzQDEyMw==",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpDb3dib3lzQDEyMw==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpDb3dib3lzQDEyMw==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8a7c24c0f106c158b3bc58cf6c7f15dc6d9c2077",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpDb3dib3lzQDEyMw==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpDb3dib3lzQDEyMw==",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic cm9vdDpyb290
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 5.109679357498383,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "881c6ff33b18fd384cae04f35b3618dc",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e074d5a0dfedce4ba9b57505700b0cf96d507f54",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 110,
"payload_entropy": 5.164937328317166,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8ffb8db6ee2b39e43d4e54804a22d21a",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "362040cdc57386b8299cb98159be61d061a6f460",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic bmFnaW9zNDpuYWdpb3M0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 110,
"payload_entropy": 5.263997300610255,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "9f2ecde090b9996c21ffa4a665c98086",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bmFnaW9zNDpuYWdpb3M0\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bmFnaW9zNDpuYWdpb3M0\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bmFnaW9zNDpuYWdpb3M0",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bmFnaW9zNDpuYWdpb3M0\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bmFnaW9zNDpuYWdpb3M0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "063afd17a269e788dc9a05eeb63ad4656aa2de92",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bmFnaW9zNDpuYWdpb3M0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic bmFnaW9zNDpuYWdpb3M0",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic YWRtaW46MTIzcXdl
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.1581416541989755,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "457a6f4b73137ea449f85bdd2e410e2b",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46MTIzcXdl\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46MTIzcXdl\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46MTIzcXdl",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46MTIzcXdl\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46MTIzcXdl",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "027d1ddf476effe1bb4d6300fa1f96f2f12646ad",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46MTIzcXdl",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46MTIzcXdl",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic cm9vdDpoYXBweXR1Z3NiYWtlcnk5MA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 122,
"payload_entropy": 5.458075428360036,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c5d4b617288d08d72750ee4b5eb3fa85",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpoYXBweXR1Z3NiYWtlcnk5MA==\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpoYXBweXR1Z3NiYWtlcnk5MA==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpoYXBweXR1Z3NiYWtlcnk5MA==",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpoYXBweXR1Z3NiYWtlcnk5MA==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpoYXBweXR1Z3NiYWtlcnk5MA==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4dbf8286466d9d32e632465d8ca40ad46536784a",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpoYXBweXR1Z3NiYWtlcnk5MA==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpoYXBweXR1Z3NiYWtlcnk5MA==",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic dXNlcjp1c2VyMTIz
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.173109134275697,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "79451397170268107936affdb9a91d7d",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4f57e10374d17412a538e8677258b74212326623",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjp1c2VyMTIz",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic ODg4ODo4ODg4
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 4.972267470919917,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e6bfd2797b3ceecda0b3e81575a57967",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4801cff59bd753bb17e4b8f8849504b2e9c79b76",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ODg4ODo4ODg4",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 130,
"payload_entropy": 5.340879045211775,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c016e18957b3c40f3b117a27a5bbd83d",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f4cb9f844462ed2f311f2d89edc45765c7d3ca5d",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic ODg4Ojg4OA==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 5.055661955495178,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "40a630194f46010e845cc981ac519fbb",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2b8ae26bc797040682ef682e012ff82e5fef3c72",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ODg4Ojg4OA==",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic YWRtaW46cGZzZW5zZQ==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 110,
"payload_entropy": 5.186667869458651,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8c1c55a34c78f614f3b5c04293a359ef",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46cGZzZW5zZQ==\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46cGZzZW5zZQ==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46cGZzZW5zZQ==",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46cGZzZW5zZQ==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46cGZzZW5zZQ==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "98feaad068af54ab077e330a7b2790d086e7b2f5",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46cGZzZW5zZQ==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46cGZzZW5zZQ==",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic cm9vdDptZWl5b3VtaW1h
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 110,
"payload_entropy": 5.2753165051360424,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e35a63ce474583d198f407a1c7fa7f9e",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDptZWl5b3VtaW1h\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDptZWl5b3VtaW1h\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDptZWl5b3VtaW1h",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDptZWl5b3VtaW1h\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDptZWl5b3VtaW1h",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c237dd2a3011d4b99347dac537b0c9acade5e955",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDptZWl5b3VtaW1h",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDptZWl5b3VtaW1h",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic YWRtaW46MjE=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 102,
"payload_entropy": 5.092509260199235,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cd7c733dd3c196b0ebe61caf1b754483",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46MjE=\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46MjE=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46MjE=",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46MjE=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46MjE=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "02eae4ca00dba5ddad252418e25a265e1d8b7fe3",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46MjE=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46MjE=",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic cm9vdDpyb290
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 100,
"payload_entropy": 5.1147575355688835,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fc5368eb49e2b19f90f8a7bcf294325a",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "217d86f0c582aab9bfef97c634b22a35a41f5da6",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpyb290",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic cm9vdDpwYXNzd29yZEAyMDI1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 114,
"payload_entropy": 5.29284714177318,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fd133a6f45cda952ee2721ebfb481919",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZEAyMDI1\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZEAyMDI1\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZEAyMDI1",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZEAyMDI1\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZEAyMDI1",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "005255a0aaefeb61100e6b1804e4673f47990b63",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZEAyMDI1",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cm9vdDpwYXNzd29yZEAyMDI1",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic ZGFuOmRhbnBhc3M=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.235892360993184,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a222bfe2789d311b255b3c1efe8c0e89",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ZGFuOmRhbnBhc3M=\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ZGFuOmRhbnBhc3M=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ZGFuOmRhbnBhc3M=",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ZGFuOmRhbnBhc3M=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ZGFuOmRhbnBhc3M=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c6740349232886d34e98effd1b249fa5e3abd91d",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ZGFuOmRhbnBhc3M=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic ZGFuOmRhbnBhc3M=",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic c3lzY29pbjpzeXNjb2lu
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 110,
"payload_entropy": 5.220771050590586,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "404f880996d9c56c969b55a037da9e61",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic c3lzY29pbjpzeXNjb2lu\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic c3lzY29pbjpzeXNjb2lu\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic c3lzY29pbjpzeXNjb2lu",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic c3lzY29pbjpzeXNjb2lu\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic c3lzY29pbjpzeXNjb2lu",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8cde522d82bf7848f3cea469c7676f468cdfbb95",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic c3lzY29pbjpzeXNjb2lu",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic c3lzY29pbjpzeXNjb2lu",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic cGFzc3dvcmQ6cGFzc3dvcmQ=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 114,
"payload_entropy": 5.201765699928771,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2025529d6cb28829f2c17742d93aa9a7",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cGFzc3dvcmQ6cGFzc3dvcmQ=\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cGFzc3dvcmQ6cGFzc3dvcmQ=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cGFzc3dvcmQ6cGFzc3dvcmQ=",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cGFzc3dvcmQ6cGFzc3dvcmQ=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cGFzc3dvcmQ6cGFzc3dvcmQ=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "dc2cfff9c10dcd6a6a516ec68954576a0ca59d7f",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cGFzc3dvcmQ6cGFzc3dvcmQ=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic cGFzc3dvcmQ6cGFzc3dvcmQ=",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic czEwYXJuYXVkOjFxYXohUUFa
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 114,
"payload_entropy": 5.2778514755929455,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "50431e6569d528e7798496f19e6684e4",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic czEwYXJuYXVkOjFxYXohUUFa\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic czEwYXJuYXVkOjFxYXohUUFa\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic czEwYXJuYXVkOjFxYXohUUFa",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic czEwYXJuYXVkOjFxYXohUUFa\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic czEwYXJuYXVkOjFxYXohUUFa",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6da8d5aaa22dab30ef0a12251862d11bed4ee913",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic czEwYXJuYXVkOjFxYXohUUFa",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic czEwYXJuYXVkOjFxYXohUUFa",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 35,
"payload_entropy": 4.150292659616667,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "707297e0d9e79d779571a7c99c9eb2ca",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b89ba786dc1ccf0973ada1f316c486d2fa780b68",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
4755 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:4755 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
4755
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74%
Confiance classification
74%
Risque capteur
Moyen
· 40
Confiance : Confiance 74 % — Score WAF 8
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic YWRtaW46dGh4MTEzOA==
Meta JSON brut
{
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 110,
"payload_entropy": 5.160480737447411,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 4755,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 3,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15
},
"risk_score": 40,
"tag_count": 3,
"anomaly_count": 0,
"campaign_key": "dd71f9c51c97afa55a0026bd460594a8b2926b0c",
"event_fingerprint": "c5f69e64cafcc19e7cce3f3b312f7209bb735a27",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "35cce5b10fedc47d91d777006efa83ae",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 4755,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46dGh4MTEzOA==\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46dGh4MTEzOA==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46dGh4MTEzOA==",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46dGh4MTEzOA==\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46dGh4MTEzOA==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.74,
"classification_confidence": 0.74,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cfc2861bf8c1a7951883504c7e68fcb2c9ab97e0",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 4755,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46dGh4MTEzOA==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:4755 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "4755 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 74,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 4755,
"protocol_emulated": null,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 4755,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:4755 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic YWRtaW46dGh4MTEzOA==",
"target_port_label": "4755 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "4755"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic eTp5
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 94,
"payload_entropy": 4.9945335015276955,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "89f077ca96cd6aca8df414423a5ee3ba",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic eTp5\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic eTp5\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic eTp5",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic eTp5\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic eTp5",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "98bf6784804343c043922c06ebd960130d191191",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic eTp5",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic eTp5",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic MTIzNDU6MTIzNDU=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.0944163004049825,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "25fd99797956e72617b496e3572d1e5b",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "75e7eea021d2ec5610bd547115b0ac406e1f76b1",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic d3d3OjEy
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 98,
"payload_entropy": 5.049402799051357,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4abc9f98a9d949706e12420b8e5a3250",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic d3d3OjEy\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic d3d3OjEy\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic d3d3OjEy",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic d3d3OjEy\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic d3d3OjEy",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d6d85ad56bb2fd948042ea3a1242ece1950f7c39",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic d3d3OjEy",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic d3d3OjEy",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic Y2VydGJvdDoxMjM=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.239574998026798,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2d252abb6e237778dcdb5812b792039d",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic Y2VydGJvdDoxMjM=\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic Y2VydGJvdDoxMjM=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic Y2VydGJvdDoxMjM=",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic Y2VydGJvdDoxMjM=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic Y2VydGJvdDoxMjM=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "03e305b8cb83142e31e69023f7f945f947a88753",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic Y2VydGJvdDoxMjM=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic Y2VydGJvdDoxMjM=",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic dGVzdGluZzp0ZXN0aW5n
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.2360978642065374,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "49212f0bce3d017bc20bd3a156b51979",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dGVzdGluZzp0ZXN0aW5n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dGVzdGluZzp0ZXN0aW5n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dGVzdGluZzp0ZXN0aW5n",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dGVzdGluZzp0ZXN0aW5n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dGVzdGluZzp0ZXN0aW5n",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "93061ffaba5d6a10a50c1c0da3e4df737472a81c",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dGVzdGluZzp0ZXN0aW5n",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dGVzdGluZzp0ZXN0aW5n",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 0,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": null,
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 35,
"payload_entropy": 4.150292659616667,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "707297e0d9e79d779571a7c99c9eb2ca",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b89ba786dc1ccf0973ada1f316c486d2fa780b68",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 0,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic dXNlcjE6cGFzczE=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 106,
"payload_entropy": 5.144840620857305,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8f2c791f8578f99f35ffc474d6284c6a",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3899f685caf178d76aeb32a5204f34252c278f07",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic dGVzdDpubw==
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 100,
"payload_entropy": 5.194757535568883,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2f048166564d5c7a12e6c1eb53f1dbaa",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dGVzdDpubw==\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dGVzdDpubw==\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dGVzdDpubw==",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dGVzdDpubw==\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dGVzdDpubw==",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d8a0e79e76d3818efcd7a73ddae208e07b473a6e",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dGVzdDpubw==",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic dGVzdDpubw==",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8080 · HTTP
|
http
|
Sonde HTTP
Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.146:80
|
Élevée
|
Moyen · 40
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
CONNECT 64.89.162.146:80
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_dangerous_method
http_method_uncommon
http_no_ua
net_web_probe
Cible HTTP
CONNECT
64.89.162.146:80
TLS SNI
—
Capteur
paris-1
|
Méthode
CONNECT
Port
8080
Chemin / cible
64.89.162.146:80
Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77%
Confiance classification
77%
Risque capteur
Moyen
· 40
Confiance : Confiance 77 % — Score WAF 8
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
CONNECT 64.89.162.146:80 HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
CONNECT 64.89.162.146:80 HTTP/1.0
Host: 64.89.162.146:80
Proxy-Authorization: Basic c2FtYmE6ZGIyYWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 81,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "146:80",
"http_ua_hash": null,
"http_host_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_target_hash": "a7a62a7c6bc77d54fc1287565f692373817f9cd7",
"http_referer_hash": null,
"http_method": "CONNECT",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 108,
"payload_entropy": 5.208352841777374,
"port_category": "registered",
"org": "PIO-Hosting GmbH",
"service": "http",
"app_proto": "http",
"asn": 198584,
"country": "US",
"dst_port": 8080,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15
},
"risk_score": 40,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2",
"event_fingerprint": "409fcac7d317f5eed7c618836a048c6d4648d5c3",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 198584,
"org": "PIO-Hosting GmbH",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c1b7108d9556b67331ff55d186a2835c",
"path_pattern_hash": "9f7803f23fadec15f02aa124215b0fcf"
},
"service_name": "http",
"target_context": {
"dst_port": 8080,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic c2FtYmE6ZGIyYWRtaW4=\r\n",
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic c2FtYmE6ZGIyYWRtaW4=\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic c2FtYmE6ZGIyYWRtaW4=",
"evidence": {
"method": "CONNECT",
"path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"request_sample": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic c2FtYmE6ZGIyYWRtaW4=\r\n",
"payload_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic c2FtYmE6ZGIyYWRtaW4=",
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
},
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.77,
"classification_confidence": 0.77,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0b133ffd7af96cda8299506163564909bc89fb06",
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic c2FtYmE6ZGIyYWRtaW4=",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 77,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 40,
"protocol": 43,
"novelty": 15,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8080,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "CONNECT",
"http_path": "64.89.162.146:80",
"request_line": "CONNECT 64.89.162.146:80 HTTP\/1.1",
"port": 8080,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.146:80",
"evidence_snippet": "CONNECT 64.89.162.146:80 HTTP\/1.0\r\nHost: 64.89.162.146:80\r\nProxy-Authorization: Basic c2FtYmE6ZGIyYWRtaW4=",
"target_port_label": "8080 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
"confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8080"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"http_dangerous_method",
"http_method_uncommon",
"http_no_ua",
"net_web_probe"
],
"asn_dc_heuristic": true
}
|