Renseignement sur les menaces

États-Unis

64.89.162.37

FAI PIO-Hosting GmbH Première vue 13/06/2026 20:52 UTC Dernière vue 21/07/2026 09:54 UTC Risque Moyen

Période analysée : 2026-06-22 → 2026-07-22

Activité suspecte · risque 40/100

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 50/100 Moyen

Première observation 13/06/2026 20:52 UTC

Dernière observation 21/07/2026 09:54 UTC

Événements (période) 119

MITRE ATT&CK principal TA0007 92 occurrences

Activité suspecte · risque 40/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « web_probe » (signaux protocolaires) · confiance 77%

Confiance 77 % — Score WAF 8

Comparaison ASN / FAI

ASN 198584 · 64.89.162.0/24 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 119 événements sur la période pour cette IP.

64.89.162.146 http-alt-8090 22/07/2026 08:16 UTC
64.89.162.38 http-alt-8090 22/07/2026 07:55 UTC
64.89.162.186 Tentative d'exploit 13/07/2026 22:43 UTC
64.89.162.62 Sonde WinRM 13/07/2026 17:11 UTC
64.89.162.129 Sonde port 3355/TCP 08/06/2026 11:42 UTC
64.89.162.78 Sonde HTTP 08/06/2026 09:09 UTC
64.89.162.139 Sonde port 23/TCP 08/06/2026 04:12 UTC
64.89.162.164 Sonde port 23/TCP 07/06/2026 22:50 UTC

Événements (filtres)

119

Première observation

13/06/2026 20:52 UTC

Dernière observation

21/07/2026 09:54 UTC

Dernière activité (filtres)

21/07/2026 09:54 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

HTTP TCP 64 HTTPS TCP 16 HDFS NAMENODE TCP 10 SSH TCP 4 HTTP ALT 8090 TCP 1

HTTP

HTTPS

HDFS NAMENODE

SSH

HTTP ALT 8090

Géolocalisation

Origine réseau déclarée

États-Unis unknown unknown

FAI / réseau

Opérateur et dernière activité ban

PIO-Hosting GmbH 0 Port 8090 web_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

Sonde HTTP · via HTTP:8090 · (sonde / probe) · → 64.89.162.37:80

Détails protocole

Méthode: CONNECT
Chemin: 64.89.162.37:80

Aperçu payload

CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic aGFkb29wOmhhZG9vcDEyMzQ1Njc4

Port / service

8090 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 77 % — Score WAF 8

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Confiance

77%

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

119 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

119 événement(s) — page 2/3

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
15/07/2026 12:06:35 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 108, "payload_entropy": 5.154794910029443, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 198584, "country": "US", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "50525e5107e51b787ca5f29093b5611d", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==\r\n\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a7903df2f81f14c42e28e1d65ded861108b51e87", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ODg4ODg4Ojg4ODg4OA==", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 12:04:29 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic ZGV2OnF3ZXJ0eTEyMzQ= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic ZGV2OnF3ZXJ0eTEyMzQ= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 108, "payload_entropy": 5.3564100721666374, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 198584, "country": "US", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b047eceb0e982821bd864eb91a959d4a", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ZGV2OnF3ZXJ0eTEyMzQ=\r\n\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ZGV2OnF3ZXJ0eTEyMzQ=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ZGV2OnF3ZXJ0eTEyMzQ=", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ZGV2OnF3ZXJ0eTEyMzQ=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ZGV2OnF3ZXJ0eTEyMzQ=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3de205e8f6ba7c56323be098154289b0a5be3374", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ZGV2OnF3ZXJ0eTEyMzQ=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ZGV2OnF3ZXJ0eTEyMzQ=", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ZGV2OnF3ZXJ0eTEyMzQ=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic ZGV2OnF3ZXJ0eTEyMzQ=", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 12:02:32 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 128, "payload_entropy": 5.388835845003375, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 198584, "country": "US", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "04f914b90b27dd3ac9dd1793bb648e10", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=\r\n\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5c6581690d7a54411a8b0193c78a6f5cf92f2d6d", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 12:00:28 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic cm9vdDpQNDU1d29yZDEyMzQ1 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic cm9vdDpQNDU1d29yZDEyMzQ1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 110, "payload_entropy": 5.341181164207282, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 198584, "country": "US", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "986fddd5bd14f2dc69fa3f46624eab43", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpQNDU1d29yZDEyMzQ1\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpQNDU1d29yZDEyMzQ1\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpQNDU1d29yZDEyMzQ1", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpQNDU1d29yZDEyMzQ1\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpQNDU1d29yZDEyMzQ1", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "add5ba5432bb9de9dce7ffef9f9fff2bfabd9871", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpQNDU1d29yZDEyMzQ1", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpQNDU1d29yZDEyMzQ1", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpQNDU1d29yZDEyMzQ1", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpQNDU1d29yZDEyMzQ1", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 11:58:32 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic cm9vdDpyb290 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic cm9vdDpyb290 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 98, "payload_entropy": 5.221390074278638, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 198584, "country": "US", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ad99d4459ff9a04bf0ff76518e26a0bf", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpyb290", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpyb290\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpyb290", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "676fb2498ca6c352ffc075c270472aec98a59807", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpyb290", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpyb290", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpyb290", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDpyb290", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 11:56:29 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 108, "payload_entropy": 5.300854516611083, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 198584, "country": "US", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "1f9a65e2f86910af91fced2b4442b736", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "983edeb431c92814714db929df91869e60596c1f", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 11:54:20 UTC	TCP	8020 · HDFS NAMENODE	hdfs-namenode	Flood / DDoS http flood · via HDFS NAMENODE:8020 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HDFS-NAMENODE WAF — Recommandation Surveiller Tags hdfs_namenode_emulated hdfs_namenode_payload net_hdfs_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8020 Chemin / cible — Service HDFS NAMENODE Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic dHVyYm86dHVyYm8xMjM= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63", "emulator_response_len": 144, "bytes_in": 106, "payload_entropy": 5.2711313939508235, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "hdfs-namenode", "app_proto": "hdfs-namenode", "asn": 198584, "country": "US", "dst_port": 8020, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf", "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "hdfs-namenode", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "302706e6dfd10e8ca5d9e40d3e1c5271", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 8020, "service": "hdfs-namenode", "service_name": "hdfs-namenode", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cb29a96bc4c3c8d8af7350c6641a5736d7bcbf52", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 30, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE", "dst_port": 8020, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-hdfs-namenode", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "port": 8020, "service": "hdfs-namenode", "service_label_fr": "HDFS NAMENODE" }, "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=", "target_port_label": "8020 \u00b7 HDFS NAMENODE", "emulator_service": "hdfs-namenode", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "hdfs_namenode", "service_banner": "honeypot-hdfs-namenode", "service_os": "linux", "dst_port": "8020" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "hdfs_namenode_emulated", "hdfs_namenode_payload", "net_hdfs_probe" ], "asn_dc_heuristic": true }
15/07/2026 03:38:31 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 104, "payload_entropy": 5.147555526926021, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "https", "app_proto": "https", "asn": 198584, "country": "US", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2068221cd3cec303e599f87629b22f20", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d6de76e8c498d50977b4eabc5f0943296a9ea43a", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 03:37:33 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic YWRtaW46MjYwNTE5NzY= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic YWRtaW46MjYwNTE5NzY= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 108, "payload_entropy": 5.278960739049969, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "https", "app_proto": "https", "asn": 198584, "country": "US", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "73fb3c33b6f97983cfac97b244b08033", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=\r\n\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b807943997e940a30821a1d93cb0d6af754cf4c8", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 03:37:19 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic am9obnNvbjpqb2huc29u Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic am9obnNvbjpqb2huc29u Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 108, "payload_entropy": 5.239473123249133, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "https", "app_proto": "https", "asn": 198584, "country": "US", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8273e6750d9e9e1381d6d71a975907f5", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u\r\n\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f7956cc5027884f25f8ac0344a91a4646e99109b", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 03:35:12 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4xMjMhQCM= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4xMjMhQCM= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 112, "payload_entropy": 5.262625181962116, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "https", "app_proto": "https", "asn": 198584, "country": "US", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bc8b1d05442bcee6513fb726840032da", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjMhQCM=\r\n\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjMhQCM=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjMhQCM=", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjMhQCM=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjMhQCM=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "42a65f1e0a60b604108f2fa01ec31860205456d1", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjMhQCM=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjMhQCM=", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjMhQCM=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjMhQCM=", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 03:34:11 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic NTU1NTo1NTU1 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic NTU1NTo1NTU1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 100, "payload_entropy": 5.006210005846149, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "https", "app_proto": "https", "asn": 198584, "country": "US", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8f5a9e1fde0b7714d912cce9715582c5", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic NTU1NTo1NTU1\r\n\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic NTU1NTo1NTU1\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic NTU1NTo1NTU1", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic NTU1NTo1NTU1\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic NTU1NTo1NTU1", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e968edcfe85a2c912ca32ab17c8e3ec826cbd9c8", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic NTU1NTo1NTU1", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic NTU1NTo1NTU1", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic NTU1NTo1NTU1", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic NTU1NTo1NTU1", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 03:33:59 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic YTph Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic YTph Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 92, "payload_entropy": 5.085728532823385, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "https", "app_proto": "https", "asn": 198584, "country": "US", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8025da2508951c8d1e940b54d9d587ff", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YTph\r\n\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YTph\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YTph", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YTph\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YTph", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "beec4160dd2c7ec6e43da18b1fd3e08f66f6cf93", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YTph", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YTph", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YTph", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YTph", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 03:33:10 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic cm9vdDp3c3hxYXoxMjM= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic cm9vdDp3c3hxYXoxMjM= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 106, "payload_entropy": 5.346603092064029, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "https", "app_proto": "https", "asn": 198584, "country": "US", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4b68d567d24b8bc31ef8a55c3f0c780a", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDp3c3hxYXoxMjM=\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDp3c3hxYXoxMjM=\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDp3c3hxYXoxMjM=", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDp3c3hxYXoxMjM=\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDp3c3hxYXoxMjM=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3aedbdea012b2998588626386294b577fc18fc8f", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDp3c3hxYXoxMjM=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDp3c3hxYXoxMjM=", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDp3c3hxYXoxMjM=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDp3c3hxYXoxMjM=", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 03:32:08 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 64.89.162.37:80 HTTP/1.0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 34, "payload_entropy": 4.300554385304355, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "https", "app_proto": "https", "asn": 198584, "country": "US", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 0 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3122dcc84866b29d7b318a154019d9e0", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "451ddec459717225ac56550c5cd44810cb6cd385", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 03:31:57 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 64.89.162.37:80 HTTP/1.0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 34, "payload_entropy": 4.300554385304355, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "https", "app_proto": "https", "asn": 198584, "country": "US", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 0 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3122dcc84866b29d7b318a154019d9e0", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "451ddec459717225ac56550c5cd44810cb6cd385", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 03:30:05 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic cGV0ZXI6MTIzMTIz Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic cGV0ZXI6MTIzMTIz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 104, "payload_entropy": 5.217220070174449, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "https", "app_proto": "https", "asn": 198584, "country": "US", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0afd5b5dbbd53258526efa57a477a2b9", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cGV0ZXI6MTIzMTIz\r\n\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cGV0ZXI6MTIzMTIz\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cGV0ZXI6MTIzMTIz", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cGV0ZXI6MTIzMTIz\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cGV0ZXI6MTIzMTIz", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f5002427d21a2bbe32a26f9b502353d4e7cc0e34", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cGV0ZXI6MTIzMTIz", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cGV0ZXI6MTIzMTIz", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cGV0ZXI6MTIzMTIz", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cGV0ZXI6MTIzMTIz", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 03:29:56 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic dWJ1bnR1OjEyMzQ1Ng== Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic dWJ1bnR1OjEyMzQ1Ng== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 108, "payload_entropy": 5.342430673978425, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "https", "app_proto": "https", "asn": 198584, "country": "US", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "64afb7d6e75712fd793b2a200d7df91a", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dWJ1bnR1OjEyMzQ1Ng==\r\n\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dWJ1bnR1OjEyMzQ1Ng==\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dWJ1bnR1OjEyMzQ1Ng==", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dWJ1bnR1OjEyMzQ1Ng==\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dWJ1bnR1OjEyMzQ1Ng==", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ada8e6b0346fcd268cae19c6e081b74b45962fa4", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dWJ1bnR1OjEyMzQ1Ng==", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dWJ1bnR1OjEyMzQ1Ng==", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dWJ1bnR1OjEyMzQ1Ng==", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dWJ1bnR1OjEyMzQ1Ng==", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 03:29:07 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic YWRtaW46YWRtaW4= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 104, "payload_entropy": 5.147555526926021, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "https", "app_proto": "https", "asn": 198584, "country": "US", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2068221cd3cec303e599f87629b22f20", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d6de76e8c498d50977b4eabc5f0943296a9ea43a", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 03:28:08 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic YWRtaW46cm9vdEAxMTE= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic YWRtaW46cm9vdEAxMTE= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 108, "payload_entropy": 5.290489558474381, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "https", "app_proto": "https", "asn": 198584, "country": "US", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e1ccea8626912696f2776ea1676943bb", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46cm9vdEAxMTE=\r\n\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46cm9vdEAxMTE=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46cm9vdEAxMTE=", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46cm9vdEAxMTE=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46cm9vdEAxMTE=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5a09f6ed70be8b911442b884114847d0663b26dc", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46cm9vdEAxMTE=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46cm9vdEAxMTE=", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46cm9vdEAxMTE=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46cm9vdEAxMTE=", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 03:27:58 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic YWRtaW46MjYwNTE5NzY= Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic YWRtaW46MjYwNTE5NzY= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 108, "payload_entropy": 5.278960739049969, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "https", "app_proto": "https", "asn": 198584, "country": "US", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "73fb3c33b6f97983cfac97b244b08033", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=\r\n\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b807943997e940a30821a1d93cb0d6af754cf4c8", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MjYwNTE5NzY=", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 03:27:03 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic am9obnNvbjpqb2huc29u Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) Cred Basic auth spray HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic am9obnNvbjpqb2huc29u Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 108, "payload_entropy": 5.239473123249133, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "https", "app_proto": "https", "asn": 198584, "country": "US", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "Cred Basic auth spray", "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0463", "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8273e6750d9e9e1381d6d71a975907f5", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u\r\n\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f7956cc5027884f25f8ac0344a91a4646e99109b", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 15, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic am9obnNvbjpqb2huc29u", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
15/07/2026 03:26:53 UTC	TCP	9443 · HTTPS	https	Flood / DDoS http flood · via HTTPS:9443 · (tentative d'exploit)	Élevée	Moyen · 46
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS WAF — Recommandation Surveiller Tags http_alt_port net_web_probe websphere_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9443 Chemin / cible — Service HTTPS Payload CONNECT 64.89.162.37:80 HTTP/1.0 Pourquoi cette classification : Type « http_flood » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Moyen · 46 Confiance : Confiance 49 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0418 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) HTTP CONNECT method ActiveMQ STOMP Squid HTTP proxy HTTPS alt 9443 probe User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 34, "payload_entropy": 4.300554385304355, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "https", "app_proto": "https", "asn": 198584, "country": "US", "dst_port": 9443, "risk_waf": 8, "risk_classification": 80, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 33, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.1, "risk_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 0 }, "risk_score": 46, "tag_count": 3, "anomaly_count": 0, "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0", "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0418" ], "kb_rule_ids": [ "pat-0418" ], "matched_patterns": [ "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "matched_pattern_names": [ "HTTP CONNECT method", "ActiveMQ STOMP", "Squid HTTP proxy", "HTTPS alt 9443 probe" ], "pattern_ids": [ "pat-0418", "pat-0559", "pat-0568", "pat-0600" ], "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 0, "risk_score": 46 }, "named_classification_skipped": false, "service_name": "https", "risk_confidence_factor": 49, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3122dcc84866b29d7b318a154019d9e0", "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789" }, "target_context": { "dst_port": 9443, "service": "https", "service_name": "https", "risk_score": 46 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "evidence": { "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "ddos" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "451ddec459717225ac56550c5cd44810cb6cd385", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 80, "behavior": 0, "geo": 40, "protocol": 33, "novelty": 0, "risk_score": 46 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 46, "risk_label": "Moyen", "service_name": "https", "service_label_fr": "HTTPS", "dst_port": 9443, "protocol_emulated": true, "tags_summary": [ "pat-0418" ], "tags_summary_labels_fr": [ "pat-0418" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0", "port": 9443, "service": "https", "service_label_fr": "HTTPS" }, "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "target_port_label": "9443 \u00b7 HTTPS", "emulator_service": "https", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https", "service_banner": "honeypot-https", "service_os": "linux", "dst_port": "9443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_alt_port", "net_web_probe", "websphere_probe" ], "asn_dc_heuristic": true }
13/07/2026 08:35:09 UTC	TCP	10721 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:10721 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 10721 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Meta JSON brut { "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 57, "payload_entropy": 4.43945278670473, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 10721, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "182713dc802906ed01e445481fa6bb28cfa3c580", "event_fingerprint": "f6138ed19c9a7ce5d8d91ffa48ef14785720f1c9", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2edc73d0f69a8ad19441c30567010027", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 10721, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6cead3119563007acc763a53f400c761389d9f49", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 10721, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80", "attack_vector": "Sonde HTTP \u00b7 via HTTP:10721 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "10721 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10721, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 10721, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:10721 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80", "target_port_label": "10721 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10721" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
13/07/2026 08:35:03 UTC	TCP	10721 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:10721 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 10721 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic eW9zaGk6eW9zaGkxMjM= Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.278960739049971, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 10721, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "182713dc802906ed01e445481fa6bb28cfa3c580", "event_fingerprint": "f6138ed19c9a7ce5d8d91ffa48ef14785720f1c9", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "f7fc64f0d0b054e3e59437530da2864c", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 10721, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic eW9zaGk6eW9zaGkxMjM=\r\n\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic eW9zaGk6eW9zaGkxMjM=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic eW9zaGk6eW9zaGkxMjM=", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic eW9zaGk6eW9zaGkxMjM=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic eW9zaGk6eW9zaGkxMjM=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "24d61bd5b3a248028d381eaf3e7ce07069dce8ea", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 10721, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic eW9zaGk6eW9zaGkxMjM=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:10721 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "10721 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10721, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 10721, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:10721 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic eW9zaGk6eW9zaGkxMjM=", "target_port_label": "10721 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10721" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
13/07/2026 08:35:00 UTC	TCP	10721 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:10721 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 10721 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic MTIzNDU2NzoxMjM0NTY3 Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.210146550113934, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 10721, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "182713dc802906ed01e445481fa6bb28cfa3c580", "event_fingerprint": "f6138ed19c9a7ce5d8d91ffa48ef14785720f1c9", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "28e89f0d77f5f4d599833db4e3cf520f", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 10721, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic MTIzNDU2NzoxMjM0NTY3\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic MTIzNDU2NzoxMjM0NTY3\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic MTIzNDU2NzoxMjM0NTY3", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic MTIzNDU2NzoxMjM0NTY3\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic MTIzNDU2NzoxMjM0NTY3", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "004f28a3b93a7d26a8c4272189c3304f84185f4a", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 10721, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic MTIzNDU2NzoxMjM0NTY3", "attack_vector": "Sonde HTTP \u00b7 via HTTP:10721 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "10721 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 10721, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 10721, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:10721 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic MTIzNDU2NzoxMjM0NTY3", "target_port_label": "10721 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "10721" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
13/07/2026 06:30:15 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE= Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.346062485247351, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "43789ad9518b27e453823ff121767efe2e005bb8", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "036bcbd3dd64394314c139b37502e608", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=\r\n\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6e0f6f058bf2b5834030209a36128adb00cb3fe0", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjowOU4xUkNhMUhzMzE=", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
13/07/2026 06:29:54 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic YWRtaW46MTIzNDU2 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.2374110843101205, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "43789ad9518b27e453823ff121767efe2e005bb8", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "59c31b9210ba4c0226ec9cf00a5761d8", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2\r\n\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bd8987af1ce50bb70b3c6d4d2a0048eee63f1fda", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU2", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
13/07/2026 06:29:44 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic dXNlcjM6MTIzNA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 104, "payload_entropy": 5.259186685334067, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "43789ad9518b27e453823ff121767efe2e005bb8", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "04c41818374c1f517d77c0a49990a8dd", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjM6MTIzNA==\r\n\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjM6MTIzNA==\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjM6MTIzNA==", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjM6MTIzNA==\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjM6MTIzNA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a338b7c202edfa7afda3436b5895c88e379d76dc", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjM6MTIzNA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjM6MTIzNA==", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 72 }
13/07/2026 06:29:33 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 34, "payload_entropy": 4.300554385304355, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "43789ad9518b27e453823ff121767efe2e005bb8", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3122dcc84866b29d7b318a154019d9e0", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "192c0aea27e63eededdc7de878c8c6b0401a2372", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
13/07/2026 06:29:25 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 128, "payload_entropy": 5.5028209267673045, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "43789ad9518b27e453823ff121767efe2e005bb8", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "914e30470c268e707477d49bbe7ace49", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2295099918dadff6cbbc88de2d9d4782d4aa5d4a", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic bG9jYWxob3N0Om1Gd09IQVlpYndPZEREY1ZKWGVC", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
13/07/2026 06:29:17 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.3114586557567005, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "43789ad9518b27e453823ff121767efe2e005bb8", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d233fdaacca16102a7a3b6e0f12d108e", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a7f1577bb33ac8ddde0cf9ba399b6b3d5ea1a099", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true, "behavior_alert_count": 1, "behavior_priority": 72 }
13/07/2026 06:29:14 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 34, "payload_entropy": 4.300554385304355, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "43789ad9518b27e453823ff121767efe2e005bb8", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3122dcc84866b29d7b318a154019d9e0", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "192c0aea27e63eededdc7de878c8c6b0401a2372", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
13/07/2026 06:29:06 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic dXNlcjpwYXNz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 5.253500565378155, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "43789ad9518b27e453823ff121767efe2e005bb8", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "30668faf2a553533b933b76519cd94cc", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjpwYXNz\r\n\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjpwYXNz\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjpwYXNz", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjpwYXNz\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjpwYXNz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4339887570db4c1dd7a475fd33e801fff427a1c8", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjpwYXNz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjpwYXNz", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
13/07/2026 06:28:55 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic dmFtc2hpOnZhbXNoaTEyMw== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 112, "payload_entropy": 5.359542619214556, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "43789ad9518b27e453823ff121767efe2e005bb8", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "efb0add803cec9c4fbae99f9eb0d9a1a", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dmFtc2hpOnZhbXNoaTEyMw==\r\n\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dmFtc2hpOnZhbXNoaTEyMw==\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dmFtc2hpOnZhbXNoaTEyMw==", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dmFtc2hpOnZhbXNoaTEyMw==\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dmFtc2hpOnZhbXNoaTEyMw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "773317f22f97e0c2c0eadff06d7886aabda5f671", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dmFtc2hpOnZhbXNoaTEyMw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dmFtc2hpOnZhbXNoaTEyMw==", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
12/07/2026 06:39:53 UTC	TCP	3000 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:3000 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3000 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic dXNlcjpBYmNkMTIzNA== Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.367014211312255, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 3000, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "37a03c556f97e2bb5c654b6686d9652b124da15d", "event_fingerprint": "86757f0d2a2b04dc48d8dfbaeaef09aca14a2e01", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "64f0690aa908567f0045a9149078e127", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==\r\n\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5acf73d4a9efa2db6eba5082d0f9927a3bab121f", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:3000 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dXNlcjpBYmNkMTIzNA==", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
12/07/2026 06:36:46 UTC	TCP	18419 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:18419 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 18419 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic bXlzcWw6Q3hWbjFnZVJrSlFxMHlVYw== Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 120, "payload_entropy": 5.526350987918954, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 18419, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "796981cbf49dc4c266b829299ded31cb26df0323", "event_fingerprint": "6274807ccf0247a7cacbfdd0b75befc1673116f9", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "bcbead42e4393cdacb7ebc3c566700f7", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 18419, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic bXlzcWw6Q3hWbjFnZVJrSlFxMHlVYw==\r\n\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic bXlzcWw6Q3hWbjFnZVJrSlFxMHlVYw==\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic bXlzcWw6Q3hWbjFnZVJrSlFxMHlVYw==", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic bXlzcWw6Q3hWbjFnZVJrSlFxMHlVYw==\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic bXlzcWw6Q3hWbjFnZVJrSlFxMHlVYw==", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2b7841355ea6a91232ab098503e4a2834a2add4b", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 18419, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic bXlzcWw6Q3hWbjFnZVJrSlFxMHlVYw==", "attack_vector": "Sonde HTTP \u00b7 via HTTP:18419 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "18419 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 18419, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 18419, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:18419 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic bXlzcWw6Q3hWbjFnZVJrSlFxMHlVYw==", "target_port_label": "18419 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "18419" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
11/07/2026 05:42:33 UTC	TCP	3128 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:3128 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic cm9vdDEyMzpyb290MTIz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 106, "payload_entropy": 5.300559841863688, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 3128, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "b9dd6f6781a910de094975f48731d7c779716dc8", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "40d68d300c1c5debcf4ed4e33f42c350", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDEyMzpyb290MTIz\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDEyMzpyb290MTIz\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDEyMzpyb290MTIz", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDEyMzpyb290MTIz\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDEyMzpyb290MTIz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "142fea6ea55b7775b103b3e87ef27cc01c662d1b", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDEyMzpyb290MTIz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDEyMzpyb290MTIz", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
11/07/2026 05:38:39 UTC	TCP	3128 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:3128 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.3114586557567005, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 3128, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "b9dd6f6781a910de094975f48731d7c779716dc8", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d233fdaacca16102a7a3b6e0f12d108e", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "bb949e21efee9925a9e256b8f76c6fc664877af9", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
11/07/2026 02:32:08 UTC	TCP	3128 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:3128 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic cm9vdDo5OTk5 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 5.217404160633787, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 3128, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "b9dd6f6781a910de094975f48731d7c779716dc8", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "85e266a576a163b00aa2b27cba43e6ac", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDo5OTk5\r\n\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDo5OTk5\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDo5OTk5", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDo5OTk5\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDo5OTk5", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e8955f853b7e880059eca2b42b98d6c12885825d", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDo5OTk5", "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDo5OTk5", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
11/07/2026 00:24:53 UTC	TCP	4145 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:4145 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 4145 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.3114586557567005, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 4145, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d7155fae81de512c7b7d514b1aa03dbca2ba0121", "event_fingerprint": "8c0f3cc7bfc95141f0a20088a8c067f5434b1b73", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "d233fdaacca16102a7a3b6e0f12d108e", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 4145, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e7a174aad7e36e7db81160907e313ca04c91b540", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 4145, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "attack_vector": "Sonde HTTP \u00b7 via HTTP:4145 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "4145 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 4145, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 4145, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:4145 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic dGVzdDEyMzp0ZXN0MTIz", "target_port_label": "4145 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "4145" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
10/07/2026 23:56:02 UTC	TCP	4145	—	Sonde port Sonde port · port 4145 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4145 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": null, "app_proto": null, "asn": 198584, "country": "US", "dst_port": 4145, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "f1981b07a565ecdb03a1465f580e17f1bf82ab5d", "event_fingerprint": "3dfd86b441699aa8c5da13fc14bd97bdb502407e", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 4145, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d9b69485d984e947fe897c13a741489a73c7f405", "protocol_details": { "port": 4145 }, "attack_vector": "Sonde port \u00b7 port 4145 \u00b7 (sonde \/ probe)", "target_port_label": "4145", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 4145, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 4145 }, "attack_vector": "Sonde port \u00b7 port 4145 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "4145", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "4145" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
10/07/2026 23:44:08 UTC	TCP	3128 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:3128 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic cG9zdGdyZXM6MWEyYjNj Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 108, "payload_entropy": 5.3205368964173125, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 3128, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "b9dd6f6781a910de094975f48731d7c779716dc8", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4ffb950b43a7f4eb6349b759d0873666", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6MWEyYjNj\r\n\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6MWEyYjNj\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6MWEyYjNj", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6MWEyYjNj\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6MWEyYjNj", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1f213800345b69b646237bae865babed9e73f520", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6MWEyYjNj", "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cG9zdGdyZXM6MWEyYjNj", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
10/07/2026 23:44:06 UTC	TCP	3128 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:3128 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 59, "payload_entropy": 4.443054965132221, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 3128, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "727b94996eef191c4ca938096611397d640aa6b6", "event_fingerprint": "b9dd6f6781a910de094975f48731d7c779716dc8", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "08c8c1fe0a687ec243ebac5596647ddd", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\n\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a9441d6d6e6a6f404d94b1ac0828d6749f795ad7", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80", "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }
10/07/2026 21:08:52 UTC	TCP	28040 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:28040 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 28040 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 74% Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Host: 64.89.162.37:80 Proxy-Authorization: Basic cm9vdDphJ3Mh Meta JSON brut { "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 100, "payload_entropy": 5.2508539403132515, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 28040, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "01566fc04eff96f5f747e813265026a1db45fbe7", "event_fingerprint": "a9ea53855ce35c58c48a2e6dafae6a17fb1aea4c", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8960be862e664d05fe3fb59285af07c7", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 28040, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDphJ3Mh\r\n\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDphJ3Mh\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDphJ3Mh", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDphJ3Mh\r\n\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDphJ3Mh", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.74, "classification_confidence": 0.74, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ec427812062cd7084328849d9c3e1bdbb39a21ad", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 28040, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDphJ3Mh", "attack_vector": "Sonde HTTP \u00b7 via HTTP:28040 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "28040 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 74, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 28040, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 28040, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:28040 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\nHost: 64.89.162.37:80\r\nProxy-Authorization: Basic cm9vdDphJ3Mh", "target_port_label": "28040 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "28040" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
10/07/2026 20:48:53 UTC	TCP	4145	—	Sonde port Sonde port · port 4145 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4145 Chemin / cible — Payload Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Meta JSON brut { "bytes_in": 4, "payload_entropy": 1.5, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": null, "app_proto": null, "asn": 198584, "country": "US", "dst_port": 4145, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "f1981b07a565ecdb03a1465f580e17f1bf82ab5d", "event_fingerprint": "3dfd86b441699aa8c5da13fc14bd97bdb502407e", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8", "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 4145, "risk_score": 44 }, "payload_preview": "\u0005\u0002\u0000\u0002", "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "evidence": { "request_sample": "\u0005\u0002\u0000\u0002", "payload_snippet": "\u0005\u0002\u0000\u0002", "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "adc2789a7fdeba62cfef15e70a9b0395fc3c7c06", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 4145 }, "attack_vector": "Sonde port \u00b7 port 4145 \u00b7 (sonde \/ probe)", "target_port_label": "4145", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 4145, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0005\u0002\u0000\u0002", "port": 4145 }, "attack_vector": "Sonde port \u00b7 port 4145 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "4145", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "4145" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
10/07/2026 20:48:53 UTC	TCP	4145	—	proxy probe proxy probe · port 4145 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags socks4_greeting Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4145 Chemin / cible — Payload P Pourquoi cette classification : Type « proxy_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0768 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) P Meta JSON brut { "bytes_in": 9, "payload_entropy": 1.4466166676282082, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": null, "app_proto": null, "asn": 198584, "country": "US", "dst_port": 4145, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "0144ddec2594bc32e254fef8a4bf56c56fcc366b", "event_fingerprint": "eb48a420247978e5c45183a595092bcdf57b6c63", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0768" ], "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 35 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "ac162eba54695d7d13c3405dc0dc7492", "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3" }, "target_context": { "dst_port": 4145, "risk_score": 35 }, "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "evidence": { "request_sample": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "payload_snippet": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "39908f98b4b1c818c2ee5d0bc45f94d3d5d2b468", "protocol_details": { "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "port": 4145 }, "evidence_snippet": "P", "attack_vector": "proxy probe \u00b7 port 4145 \u00b7 (sonde \/ probe)", "target_port_label": "4145", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 4145, "protocol_emulated": null, "tags_summary": [ "pat-0768" ], "tags_summary_labels_fr": [ "pat-0768" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0004\u0001\u0000P\u0000\u0000\u0000\u0000\u0000", "port": 4145 }, "attack_vector": "proxy probe \u00b7 port 4145 \u00b7 (sonde \/ probe)", "evidence_snippet": "P", "target_port_label": "4145", "emulator_service": null, "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "4145" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "socks4_greeting" ], "asn_dc_heuristic": true }
10/07/2026 20:48:53 UTC	TCP	4145 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:4145 · (sonde / probe) · → 1.1.1.1:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole CONNECT 1.1.1.1:443 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua Cible HTTP CONNECT 1.1.1.1:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 4145 Chemin / cible 1.1.1.1:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 74% Confiance classification 82% Corrélation +8 Risque capteur Moyen · 40 Confiance : Confiance 74 % — Score WAF 8 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 1.1.1.1:443 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 1.1.1.1:443 HTTP/1.0 Host: 1.1.1.1 Meta JSON brut { "http_header_count": 1, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "1:443", "http_ua_hash": null, "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f", "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 47, "payload_entropy": 3.912028011761936, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 4145, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 35, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0 }, "risk_score": 40, "tag_count": 3, "anomaly_count": 0, "campaign_key": "d7155fae81de512c7b7d514b1aa03dbca2ba0121", "event_fingerprint": "7348ffa26e55dc8ddc7f7d4157b31be8f8c15b94", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "eca058040bfea8cad9218ced7d8b12d9", "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4" }, "service_name": "http", "target_context": { "dst_port": 4145, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "method": "CONNECT", "path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "evidence": { "method": "CONNECT", "path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n", "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.82, "classification_confidence": 0.82, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "72581fb8539754074ca5d35153873880855c3f68", "protocol_details": { "http_method": "CONNECT", "http_path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "port": 4145, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "attack_vector": "Sonde HTTP \u00b7 via HTTP:4145 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443", "target_port_label": "4145 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 82, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 35, "novelty": 0, "risk_score": 40, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 4145, "protocol_emulated": null, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "CONNECT", "http_path": "1.1.1.1:443", "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1", "port": 4145, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:4145 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443", "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1", "target_port_label": "4145 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 74 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "4145" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "http", "port:4145" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua" ], "asn_dc_heuristic": true }
10/07/2026 20:48:49 UTC	TCP	4145	—	Sonde port Sonde port · port 4145 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4145 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": null, "app_proto": null, "asn": 198584, "country": "US", "dst_port": 4145, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3.5, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "f1981b07a565ecdb03a1465f580e17f1bf82ab5d", "event_fingerprint": "3dfd86b441699aa8c5da13fc14bd97bdb502407e", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 4145, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d9b69485d984e947fe897c13a741489a73c7f405", "protocol_details": { "port": 4145 }, "attack_vector": "Sonde port \u00b7 port 4145 \u00b7 (sonde \/ probe)", "target_port_label": "4145", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 40, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 4145, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 4145 }, "attack_vector": "Sonde port \u00b7 port 4145 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "4145", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "4145" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "asn_dc_heuristic": true }
10/07/2026 16:44:32 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → 64.89.162.37:80	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT 64.89.162.37:80 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_no_ua net_web_probe Cible HTTP CONNECT 64.89.162.37:80 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible 64.89.162.37:80 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT 64.89.162.37:80 HTTP/1.1` User-Agent — Règles WAF — Payload (extrait) CONNECT 64.89.162.37:80 HTTP/1.0 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 0, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": "37:80", "http_ua_hash": null, "http_host_hash": null, "http_target_hash": "9ec6563229bca84b1ead804cd0165ac46f5f5410", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": false, "http_ua_is_browser": false, "bytes_in": 34, "payload_entropy": 4.300554385304355, "port_category": "registered", "org": "PIO-Hosting GmbH", "service": "http", "app_proto": "http", "asn": 198584, "country": "US", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 40, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "d02da780fa50601181fd57cb8351d8fd4c9532b2", "event_fingerprint": "43789ad9518b27e453823ff121767efe2e005bb8", "city": null, "is_datacenter": true, "is_tor_hint": false, "geo": { "country": "US", "asn": 198584, "org": "PIO-Hosting GmbH", "is_datacenter": true, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3122dcc84866b29d7b318a154019d9e0", "path_pattern_hash": "8a7c2a58d79240504c562bfde52397f2" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "evidence": { "method": "CONNECT", "path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "request_sample": "CONNECT 64.89.162.37:80 HTTP\/1.0\r\n", "payload_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "192c0aea27e63eededdc7de878c8c6b0401a2372", "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 40, "protocol": 43, "novelty": 0, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "64.89.162.37:80", "request_line": "CONNECT 64.89.162.37:80 HTTP\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 64.89.162.37:80", "evidence_snippet": "CONNECT 64.89.162.37:80 HTTP\/1.0", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_no_ua", "net_web_probe" ], "asn_dc_heuristic": true }

64.89.162.37

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence