Renseignement sur les menaces

États-Unis

66.93.173.75

FAI Zenlayer Inc Première vue 06/08/2026 08:39 UTC Dernière vue 06/08/2026 23:49 UTC Risque Faible

Période analysée : 2026-07-07 → 2026-08-06

Activité suspecte · risque 35/100

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Faible · Risque max (7j) Faible

Synthèse exécutive

Profil de menace

Score de risque 35/100 Faible

Première observation 06/08/2026 08:39 UTC

Dernière observation 06/08/2026 23:49 UTC

Événements (période) 52

MITRE ATT&CK principal TA0007 52 occurrences

Activité suspecte · risque 35/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « tls_probe » (signaux protocolaires) · confiance 50%

Confiance 50 % — Score WAF 8

Comparaison ASN / FAI

ASN 62610 · 66.93.173.0/24 · ARIN — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 52 événements sur la période pour cette IP.

109.105.210.68 Sonde PostgreSQL 06/08/2026 21:58 UTC
109.105.210.69 Botnet Mozi 06/08/2026 21:57 UTC
109.105.210.67 epmd 06/08/2026 21:57 UTC
185.226.197.12 modbus probe 06/08/2026 12:17 UTC
109.105.210.99 Tentative d'exploit 06/08/2026 11:47 UTC
109.105.210.59 Sonde S7comm (OT/SCADA) 06/08/2026 10:34 UTC
109.105.210.57 Sonde S7comm (OT/SCADA) 06/08/2026 10:34 UTC
109.105.210.60 Sonde S7comm (OT/SCADA) 06/08/2026 10:34 UTC

Événements (filtres)

Première observation

06/08/2026 08:39 UTC

Dernière observation

06/08/2026 23:49 UTC

Dernière activité (filtres)

06/08/2026 23:49 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Géolocalisation

Origine réseau déclarée

États-Unis unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Zenlayer Inc 0 Port 7348 tls_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

tls probe · via TLS:7348 · (sonde / probe)

Détails protocole

Empreinte JA3: 2e37c35ce5fb522aad07303c
SNI TLS: ip-62-3-50-33.v4.isp.servpersosystems.net

Aperçu payload

lh C�� ZD�L��ԅ3�v�*H��.Z��{ v:�V��rv\q��I��X��y�wϽ;�� **�+�/�,�0̨̩��/5�jj h2

Port / service

7348 · TLS

Service émulé

TLS

Raison confiance

Confiance 50 % — Motif catalogue confirmé

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0554

Confiance

50% Confiance modérée — signal unique

Famille de menace

scanner

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

52 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

52 événement(s) — page 1/2

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
06/08/2026 23:49:57 UTC	TCP	7348 · TLS	tls	Sonde TLS tls probe · via TLS:7348 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 2e37c35ce5fb522a SNI ip-62-3-50-33.v4.isp.servpersosystems.net Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI ip-62-3-50-33.v4.isp.servpersosystems.net Capteur paris-1
Preuve / Evidence Méthode — Port 7348 Chemin / cible — Service TLS SNI TLS ip-62-3-50-33.v4.isp.servpersosystems.net Payload lh C�� ZD�L��ԅ3�v�H��.Z��{ v:�V��rv\q��I��X��y�wϽ;�� �+�/�,�0̨̩��/5�jj h2 Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) lhC�� ZD�L��ԅ3�v�H��.Z��{ v:�V��rv\q��I��X��y�wϽ;�� �+�/�,�0̨̩��/5�jjh2 Requête brute (extrait) lh C�� ZD�L��ԅ3�v�H��.Z��{ v:�V��rv\q��I��X��y�wϽ;�� *�+�/�,�0̨̩��/5�jj h2http/1.1Dih2� � �S#$!��Z�Vx�If1=��Ƥ�c^�ҫEH��@��,��㮵�.{̶n�Cͷ��rh �CB� �OMF0tv��\|[��}Pc�� Meta JSON brut { "tls_ja3_hash": "2e37c35ce5fb522aad07303c864ce615", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 625, "payload_entropy": 7.0110885716832785, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 7348, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 0.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c983e1cd55f756b178b60b589fa046ff5d5226f7", "event_fingerprint": "7c9a50b41b6bae042675fe3c4e51b1bef1aa204c", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2e37c35ce5fb522aad07303c864ce615", "payload_hash": "be974d5e48726b95d54fc1061c26c40f", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net" }, "target_context": { "dst_port": 7348, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002l\u0001\u0000\u0002h\u0003\u0003\u000bC\u0012\ufffd\ufffd ZD\ufffdL\ufffd\ufffd\ufffd\ufffd\u05053\ufffd\u0005v\ufffdH\ufffd\ufffd.Z\ufffd\ufffd\ufffd\ufffd{ v\u0014:\ufffdV\ufffd\ufffdrv\u0014\\q\ufffd\ufffdI\ufffd\ufffd\ufffdX\u001d\ufffd\ufffdy\ufffdw\u03fd;\ufffd\ufffd\u0000 \u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdjj\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\b", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002l\u0001\u0000\u0002h\u0003\u0003\u000bC\u0012\ufffd\ufffd ZD\ufffdL\ufffd\ufffd\ufffd\ufffd\u05053\ufffd\u0005v\ufffdH\ufffd\ufffd.Z\ufffd\ufffd\ufffd\ufffd{ v\u0014:\ufffdV\ufffd\ufffdrv\u0014\\q\ufffd\ufffdI\ufffd\ufffd\ufffdX\u001d\ufffd\ufffdy\ufffdw\u03fd;\ufffd\ufffd\u0000 *\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdjj\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1Di\u0000\u0005\u0000\u0003\u0002h2\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \ufffdS#$!\ufffd\ufffd\ufffdZ\ufffdV\u001dx\ufffdIf1=\ufffd\ufffd\u01a4\ufffdc^\u0005\ufffd\u001f\u04abEH\u0000\ufffd\u001a\ufffd@\ufffd\ufffd\ufffd\ufffd\u001e\ufffd\u0011,\ufffd\ufffd\u3bb5\ufffd.{\u0336n\u0017\ufffdC\u001a\u0377\ufffd\ufffdrh \ufffdCB\ufffd \ufffdOMF\u000e0t\u0003v\ufffd\u001c\ufffd\ufffd\ufffd\u0019\|[\ufffd\ufffd}Pc\ufffd\ufffd\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0002l\u0001\u0000\u0002h\u0003\u0003\u000bC\u0012\ufffd\ufffd ZD\ufffdL\ufffd\ufffd\ufffd\ufffd\u05053\ufffd\u0005v\ufffdH\ufffd\ufffd.Z\ufffd\ufffd\ufffd\ufffd{ v\u0014:\ufffdV\ufffd\ufffdrv\u0014\\q\ufffd\ufffdI\ufffd\ufffd\ufffdX\u001d\ufffd\ufffdy\ufffdw\u03fd;\ufffd\ufffd\u0000 \u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdjj\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\b", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0a5b1bfe61223075a70d6f65a541b6e123b7b48a", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002l\u0001\u0000\u0002h\u0003\u0003\u000bC\u0012\ufffd\ufffd ZD\ufffdL\ufffd\ufffd\ufffd\ufffd\u05053\ufffd\u0005v\ufffdH\ufffd\ufffd.Z\ufffd\ufffd\ufffd\ufffd{ v\u0014:\ufffdV\ufffd\ufffdrv\u0014\\q\ufffd\ufffdI\ufffd\ufffd\ufffdX\u001d\ufffd\ufffdy\ufffdw\u03fd;\ufffd\ufffd\u0000 *\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdjj\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\b", "tls_ja3": "2e37c35ce5fb522aad07303c864ce615", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 7348, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "lhC\ufffd\ufffd ZD\ufffdL\ufffd\ufffd\ufffd\ufffd\u05053\ufffdv\ufffdH\ufffd\ufffd.Z\ufffd\ufffd\ufffd\ufffd{ v:\ufffdV\ufffd\ufffdrv\\q\ufffd\ufffdI\ufffd\ufffd\ufffdX\ufffd\ufffdy\ufffdw\u03fd;\ufffd\ufffd *\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdjjh2", "attack_vector": "tls probe \u00b7 via TLS:7348 \u00b7 (sonde \/ probe)", "target_port_label": "7348 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7348, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002l\u0001\u0000\u0002h\u0003\u0003\u000bC\u0012\ufffd\ufffd ZD\ufffdL\ufffd\ufffd\ufffd\ufffd\u05053\ufffd\u0005v\ufffdH\ufffd\ufffd.Z\ufffd\ufffd\ufffd\ufffd{ v\u0014:\ufffdV\ufffd\ufffdrv\u0014\\q\ufffd\ufffdI\ufffd\ufffd\ufffdX\u001d\ufffd\ufffdy\ufffdw\u03fd;\ufffd\ufffd\u0000 *\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdjj\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\b", "tls_ja3": "2e37c35ce5fb522aad07303c864ce615", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 7348, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:7348 \u00b7 (sonde \/ probe)", "evidence_snippet": "lhC\ufffd\ufffd ZD\ufffdL\ufffd\ufffd\ufffd\ufffd\u05053\ufffdv\ufffdH\ufffd\ufffd.Z\ufffd\ufffd\ufffd\ufffd{ v:\ufffdV\ufffd\ufffdrv\\q\ufffd\ufffdI\ufffd\ufffd\ufffdX\ufffd\ufffdy\ufffdw\u03fd;\ufffd\ufffd **\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdjjh2", "target_port_label": "7348 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7348" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }
06/08/2026 23:31:16 UTC	TCP	9550 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:9550 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 20b279993ae2e137 SNI blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 Cible HTTP — TLS SNI blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 9550 Chemin / cible — Service TLS SNI TLS blacklistip.com Payload ��58��w��R�F;��mb�4�H ��w�w �i�+]a��T� ͥg��g�I��c��A�+�/�,�0̨̩� �� wblacklistip Pourquoi cette classification :* Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��58��w��R�F;��mb�4�H��w�w �i�+]a��T� ͥg��g�I��c��A�+�/�,�0̨̩� �� wblacklistip Requête brute (extrait) ��58��w��R�F;��mb�4�H ��w�w �i�+]a��T� ͥg��g�I��c��A�+�/�,�0̨̩� �� wblacklistip.com � � 2+ 3��F Meta JSON brut { "tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "blacklistip.com", "bytes_in": 1507, "payload_entropy": 7.690014449095416, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 9550, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 0.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "5e1875066794e55d5fbc185d159c773098683db2", "event_fingerprint": "e7bafc2416a9bd4f46ef181b5cbf029fe0bfe290", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "20b279993ae2e137e62b9647c6d768fb", "payload_hash": "08c1a37d576a8bf79c485079d7260750", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "tls_sni": "blacklistip.com" }, "target_context": { "dst_port": 9550, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd58\u0003\ufffd\ufffdw\u0005\ufffd\ufffdR\ufffd\u0012F;\ufffd\ufffdmb\ufffd4\u0001\ufffdH\f\ufffd\ufffd\ufffdw\u0018\ufffdw \ufffdi\ufffd+]a\ufffd\u0006\ufffdT\ufffd\r\u0365\u001fg\ufffd\ufffdg\ufffdI\u0014\ufffd\ufffd\ufffd\u000fc\ufffd\ufffd\ufffdA\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd58\u0003\ufffd\ufffdw\u0005\ufffd\ufffdR\ufffd\u0012F;\ufffd\ufffdmb\ufffd4\u0001\ufffdH\f\ufffd\ufffd\ufffdw\u0018\ufffdw \ufffdi\ufffd+]a\ufffd\u0006\ufffdT\ufffd\r\u0365\u001fg\ufffd\ufffdg\ufffdI\u0014\ufffd\ufffd\ufffd\u000fc\ufffd\ufffd\ufffdA\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip.com\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdF", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd58\u0003\ufffd\ufffdw\u0005\ufffd\ufffdR\ufffd\u0012F;\ufffd\ufffdmb\ufffd4\u0001\ufffdH\f\ufffd\ufffd\ufffdw\u0018\ufffdw \ufffdi\ufffd+]a\ufffd\u0006\ufffdT\ufffd\r\u0365\u001fg\ufffd\ufffdg\ufffdI\u0014\ufffd\ufffd\ufffd\u000fc\ufffd\ufffd\ufffdA\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "654fb246665b4910d08036295c937d1d8072af5c", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd58\u0003\ufffd\ufffdw\u0005\ufffd\ufffdR\ufffd\u0012F;\ufffd\ufffdmb\ufffd4\u0001\ufffdH\f\ufffd\ufffd\ufffdw\u0018\ufffdw \ufffdi\ufffd+]a\ufffd\u0006\ufffdT\ufffd\r\u0365\u001fg\ufffd\ufffdg\ufffdI\u0014\ufffd\ufffd\ufffd\u000fc\ufffd\ufffd\ufffdA\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "blacklistip.com", "port": 9550, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd58\ufffd\ufffdw\ufffd\ufffdR\ufffdF;\ufffd\ufffdmb\ufffd4\ufffdH\ufffd\ufffd\ufffdw\ufffdw \ufffdi\ufffd+]a\ufffd\ufffdT\ufffd\r\u0365g\ufffd\ufffdg\ufffdI\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdA\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdwblacklistip", "attack_vector": "postgres probe \u00b7 via TLS:9550 \u00b7 (sonde \/ probe)", "target_port_label": "9550 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 9550, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd58\u0003\ufffd\ufffdw\u0005\ufffd\ufffdR\ufffd\u0012F;\ufffd\ufffdmb\ufffd4\u0001\ufffdH\f\ufffd\ufffd\ufffdw\u0018\ufffdw \ufffdi\ufffd+]a\ufffd\u0006\ufffdT\ufffd\r\u0365\u001fg\ufffd\ufffdg\ufffdI\u0014\ufffd\ufffd\ufffd\u000fc\ufffd\ufffd\ufffdA\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "blacklistip.com", "port": 9550, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:9550 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd58\ufffd\ufffdw\ufffd\ufffdR\ufffdF;\ufffd\ufffdmb\ufffd4\ufffdH\ufffd\ufffd\ufffdw\ufffdw \ufffdi*\ufffd+]a\ufffd\ufffdT\ufffd\r\u0365g\ufffd\ufffdg\ufffdI\ufffd\ufffd\ufffdc\ufffd\ufffd\ufffdA\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdwblacklistip", "target_port_label": "9550 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "9550" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3" ] }
06/08/2026 23:25:31 UTC	TCP	4700	—	Sonde Kafka kafka probe · port 4700 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4700 Chemin / cible — Payload ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Requête brute (extrait) ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� # h2http/1.1 3&$ sH?�ߑ��`��%�ϋ5��߅�wM��-+ Meta JSON brut { "bytes_in": 516, "payload_entropy": 3.9791255536617784, "port_category": "registered", "org": "Zenlayer Inc", "service": null, "app_proto": null, "asn": 62610, "country": "US", "dst_port": 4700, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 3, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "d909da3f808e656add86bd5156be1a9955d72d79", "event_fingerprint": "c7d27eca92cdabc52373ecc3aa74a7c114b46cb9", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a2a0ad11f9f8f1cf9217197b97b6f064", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 4700, "risk_score": 32 }, "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003", "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f422b1d086e8f0ca378177d75051717830fd3685", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 4700 }, "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 port 4700 \u00b7 (sonde \/ probe)", "target_port_label": "4700", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 4700, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 4700 }, "attack_vector": "kafka probe \u00b7 port 4700 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "target_port_label": "4700", "emulator_service": null, "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "4700" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
06/08/2026 23:00:47 UTC	TCP	8180 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:8180 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8180 Chemin / cible — Service TLS Payload ��Ὓ��4��"��KPu�sߨ�"i �:,$��ج��꩸�E�oS({f��`��+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Ὓ��4��"��KPu�sߨ�"i �:,$��ج��꩸�E�oS({f��`��+�/�,�0̨̩� �� _� Requête brute (extrait) ��Ὓ��4��"��KPu�sߨ�"i �:,$��ج��꩸�E�oS({f��`��+�/�,�0̨̩� �� _ � � 2+ 3��L�p�I��N�L�43�t])x"�� Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.766658929304615, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 8180, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "b29962589a91ec85ea9177acbcbb0948955b414e", "event_fingerprint": "f194831082e04ed8a76ed8c3062c7ee499a817b8", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.57, "classification_confidence": 0.57, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "f8e66d3a2912c0b84634799c4d054ffc", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 8180, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u1f5b\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\u0014\ufffd\ufffdKPu\ufffds\u07e8\ufffd\"i \ufffd:,$\ufffd\ufffd\u001f\ufffd\ufffd\ufffd\u062c\ufffd\u001c\ufffd\uaa78\ufffdE\ufffdoS({\bf\ufffd\ufffd`\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u1f5b\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\u0014\ufffd\ufffdKPu\ufffds\u07e8\ufffd\"i \ufffd:,$\ufffd\ufffd\u001f\ufffd\ufffd\ufffd\u062c\ufffd\u001c\ufffd\uaa78\ufffdE\ufffdoS({\bf\ufffd\ufffd`\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffdL\ufffdp\ufffdI\ufffd\ufffdN\ufffdL\ufffd43\ufffdt])x\"\u0015\u0013\ufffd\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u1f5b\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\u0014\ufffd\ufffdKPu\ufffds\u07e8\ufffd\"i \ufffd:,$\ufffd\ufffd\u001f\ufffd\ufffd\ufffd\u062c\ufffd\u001c\ufffd\uaa78\ufffdE\ufffdoS({\bf\ufffd\ufffd`\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b2fc9fe0220eb9c7a6a6d634c5cdd6c025df78d5", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u1f5b\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\u0014\ufffd\ufffdKPu\ufffds\u07e8\ufffd\"i \ufffd:,$\ufffd\ufffd\u001f\ufffd\ufffd\ufffd\u062c\ufffd\u001c\ufffd\uaa78\ufffdE\ufffdoS({\bf\ufffd\ufffd`\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 8180, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\u1f5b\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffdKPu\ufffds\u07e8\ufffd\"i \ufffd:,$\ufffd\ufffd\ufffd\ufffd\ufffd\u062c\ufffd\ufffd\uaa78\ufffdE\ufffdoS({f\ufffd\ufffd`\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:8180 \u00b7 (sonde \/ probe)", "target_port_label": "8180 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 57, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8180, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u1f5b\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\u0004\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\u0014\ufffd\ufffdKPu\ufffds\u07e8\ufffd\"i \ufffd:,$\ufffd\ufffd\u001f\ufffd\ufffd\ufffd\u062c\ufffd\u001c\ufffd\uaa78\ufffdE\ufffdoS({\bf\ufffd\ufffd`\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 8180, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:8180 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u1f5b\ufffd\ufffd\ufffd\ufffd4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\"\ufffd\ufffd\ufffd\ufffdKPu\ufffds\u07e8\ufffd\"i \ufffd:,$\ufffd\ufffd\ufffd\ufffd\ufffd\u062c\ufffd\ufffd\uaa78\ufffdE\ufffdoS({f\ufffd\ufffd`\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "8180 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8180" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "port:843", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
06/08/2026 22:57:06 UTC	TCP	843 · TLS	tls	Sonde TLS tls probe · via TLS:843 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 5201180ac03627fe SNI www.blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI www.blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 843 Chemin / cible — Service TLS SNI TLS www.blacklistip.com Payload VR!�D?Y�;�h�~ 2c��PRs�1`[� �t��~áڦ �v��Z��7�v0� ZZ�+�/�,�0̨̩��/5�� Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0607 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) VR!�D?Y�;�h�~ 2c��PRs�1`[� �t��~áڦ �v��Z��7�v0� ZZ�+�/�,�0̨̩��/5�� Requête brute (extrait) VR!�D?Y�;�h�~ 2c��PRs�1`[� �t��~áڦ �v��Z��7�v0� ZZ�+�/�,�0̨̩��/5�� +��3+)ZZ �p ��~��k��ͬ��b��Bwww.blacklistip.com� ZZ� � L�1 4 i Meta JSON brut { "tls_ja3_hash": "5201180ac03627fe26d1d8573ad97eca", "tls_sni": "www.blacklistip.com", "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 603, "payload_entropy": 6.9961788219158585, "port_category": "well_known", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 843, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "9d141551ebda7d8e16df161d178c154ea508bad7", "event_fingerprint": "cd54000e3dbe4330b1040d146e346867cb0adb27", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0607" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "5201180ac03627fe26d1d8573ad97eca", "payload_hash": "5408def9bac4b49af2cb0d74c37d5966", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "www.blacklistip.com" }, "target_context": { "dst_port": 843, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002V\u0001\u0000\u0002R\u0003\u0003!\u0004\ufffd\u0019D?Y\ufffd\u0013;\ufffdh\ufffd~\u001b\n\u00022c\ufffd\ufffdPRs\ufffd1`[\ufffd \ufffd\u0017t\ufffd\ufffd\ufffd\ufffd~\u00e1\u06a6 \ufffdv\ufffd\ufffd\u0004\u0013\ufffdZ\ufffd\ufffd\u0017\ufffd\ufffd\u00167\ufffdv0\ufffd\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u001b\u0000\u0003", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002V\u0001\u0000\u0002R\u0003\u0003!\u0004\ufffd\u0019D?Y\ufffd\u0013;\ufffdh\ufffd~\u001b\n\u00022c\ufffd\ufffdPRs\ufffd1`[\ufffd \ufffd\u0017t\ufffd\ufffd\ufffd\ufffd~\u00e1\u06a6 \ufffdv\ufffd\ufffd\u0004\u0013\ufffdZ\ufffd\ufffd\u0017\ufffd\ufffd\u00167\ufffdv0\ufffd\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003\u0003\u00003\u0000+\u0000)ZZ\u0000\u0001\u0000\u0000\u001d\u0000 \ufffdp\u000b\u000e\ufffd\ufffd~\ufffd\u0005\ufffd\ufffd\u0005\ufffdk\ufffd\ufffd\u0016\ufffd\ufffd\u0017\u000f\ufffd\u036c\ufffd\ufffd\ufffdb\ufffd\ufffd\ufffdB\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blacklistip.com\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\bZZ\u0000\u001d\u0000\u0017\u0000\u0018\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 L\ufffd1\u0006\u000b4\ni", "payload_snippet": "\u0016\u0003\u0001\u0002V\u0001\u0000\u0002R\u0003\u0003!\u0004\ufffd\u0019D?Y\ufffd\u0013;\ufffdh\ufffd~\u001b\n\u00022c\ufffd\ufffdPRs\ufffd1`[\ufffd \ufffd\u0017t\ufffd\ufffd\ufffd\ufffd~\u00e1\u06a6 \ufffdv\ufffd\ufffd\u0004\u0013\ufffdZ\ufffd\ufffd\u0017\ufffd\ufffd\u00167\ufffdv0\ufffd\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u001b\u0000\u0003", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4c528954eb7632ecf36ffa0e517b12c067024346", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002V\u0001\u0000\u0002R\u0003\u0003!\u0004\ufffd\u0019D?Y\ufffd\u0013;\ufffdh\ufffd~\u001b\n\u00022c\ufffd\ufffdPRs\ufffd1`[\ufffd \ufffd\u0017t\ufffd\ufffd\ufffd\ufffd~\u00e1\u06a6 \ufffdv\ufffd\ufffd\u0004\u0013\ufffdZ\ufffd\ufffd\u0017\ufffd\ufffd\u00167\ufffdv0\ufffd\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u001b\u0000\u0003", "tls_ja3": "5201180ac03627fe26d1d8573ad97eca", "tls_sni": "www.blacklistip.com", "port": 843, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "VR!\ufffdD?Y\ufffd;\ufffdh\ufffd~\n2c\ufffd\ufffdPRs\ufffd1`[\ufffd \ufffdt\ufffd\ufffd\ufffd\ufffd~\u00e1\u06a6 \ufffdv\ufffd\ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffd7\ufffdv0\ufffd ZZ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd", "attack_vector": "tls probe \u00b7 via TLS:843 \u00b7 (sonde \/ probe)", "target_port_label": "843 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 843, "protocol_emulated": null, "tags_summary": [ "pat-0607" ], "tags_summary_labels_fr": [ "pat-0607" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002V\u0001\u0000\u0002R\u0003\u0003!\u0004\ufffd\u0019D?Y\ufffd\u0013;\ufffdh\ufffd~\u001b\n\u00022c\ufffd\ufffdPRs\ufffd1`[\ufffd \ufffd\u0017t\ufffd\ufffd\ufffd\ufffd~\u00e1\u06a6 \ufffdv\ufffd\ufffd\u0004\u0013\ufffdZ\ufffd\ufffd\u0017\ufffd\ufffd\u00167\ufffdv0\ufffd\u0000 ZZ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u001b\u0000\u0003", "tls_ja3": "5201180ac03627fe26d1d8573ad97eca", "tls_sni": "www.blacklistip.com", "port": 843, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:843 \u00b7 (sonde \/ probe)", "evidence_snippet": "VR!\ufffdD?Y\ufffd;\ufffdh\ufffd~\n2c\ufffd\ufffdPRs\ufffd1`[\ufffd \ufffdt\ufffd\ufffd\ufffd\ufffd~\u00e1\u06a6 \ufffdv\ufffd\ufffd\ufffdZ\ufffd\ufffd\ufffd\ufffd7\ufffdv0\ufffd ZZ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd", "target_port_label": "843 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "843" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "port:843", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }
06/08/2026 22:56:54 UTC	TCP	843	—	Sonde Kafka kafka probe · port 843 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 843 Chemin / cible — Payload ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Requête brute (extrait) ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� # h2http/1.1 3&$ sH?�ߑ��`��%�ϋ5��߅�wM��-+ Meta JSON brut { "bytes_in": 501, "payload_entropy": 3.7940870380940184, "port_category": "well_known", "org": "Zenlayer Inc", "service": null, "app_proto": null, "asn": 62610, "country": "US", "dst_port": 843, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "329b3db7c5639e7f4b6d8a8937da2d4e1b50e9d5", "event_fingerprint": "433ffef41f13914b69c4ee128d099a81fb622137", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "29b5329f45e73a6677bca0caf0ca278c", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 843, "risk_score": 32 }, "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003", "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "91ce94372b1466f60c91312d45fab0a6d0d81291", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 843 }, "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 port 843 \u00b7 (sonde \/ probe)", "target_port_label": "843", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 843, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 843 }, "attack_vector": "kafka probe \u00b7 port 843 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "target_port_label": "843", "emulator_service": null, "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "843" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
06/08/2026 22:40:28 UTC	TCP	7132 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:7132 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 20b279993ae2e137 SNI www.blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 Cible HTTP — TLS SNI www.blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 7132 Chemin / cible — Service TLS SNI TLS www.blacklistip.com Payload ��`ߡŴSt[ß�Z��xr'�^�sc#�8�� ;S� ��y�:W��=��߭H��_$�+�/�,�0̨̩� �� {www.blackli Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��`ߡŴSt[ß�Z��xr'�^�sc#�8�� ;S� ��y�:W��=��߭H��_$�+�/�,�0̨̩� �� {www.blackli Requête brute (extrait) ��`ߡŴSt[ß�Z��xr'�^�sc#�8�� ;S� ��y�:W��=��߭H��_$�+�/�,�0̨̩� �� {www.blacklistip.com � � 2+ 3�� Meta JSON brut { "tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "www.blacklistip.com", "bytes_in": 1511, "payload_entropy": 7.690138488167274, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 7132, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 0.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "cb824d41fa0a87fafa334f507a8745344798aa3f", "event_fingerprint": "6aed255c04aa658161402d0f5db3d69178a79619", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "20b279993ae2e137e62b9647c6d768fb", "payload_hash": "7173ad4134f245115aeb5af1415e81dc", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "tls_sni": "www.blacklistip.com" }, "target_context": { "dst_port": 7132, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd`\u07e1\u0174St[\u000f\u00df\ufffdZ\u0019\ufffd\ufffdxr'\ufffd\u0018^\ufffdsc\u0015#\ufffd8\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd;S\u0018\ufffd\r\ufffd\ufffd\u000ey\ufffd:W\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\u07edH\ufffd\ufffd_$\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd`\u07e1\u0174St[\u000f\u00df\ufffdZ\u0019\ufffd\ufffdxr'\ufffd\u0018^\ufffdsc\u0015#\ufffd8\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd;S\u0018\ufffd\r\ufffd\ufffd\u000ey\ufffd:W\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\u07edH\ufffd\ufffd_$\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blacklistip.com\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd`\u07e1\u0174St[\u000f\u00df\ufffdZ\u0019\ufffd\ufffdxr'\ufffd\u0018^\ufffdsc\u0015#\ufffd8\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd;S\u0018\ufffd\r\ufffd\ufffd\u000ey\ufffd:W\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\u07edH\ufffd\ufffd_$\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7051c73afcff32ce31547c7f20123f3ee4628fb0", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd`\u07e1\u0174St[\u000f\u00df\ufffdZ\u0019\ufffd\ufffdxr'\ufffd\u0018^\ufffdsc\u0015#\ufffd8\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd;S\u0018\ufffd\r\ufffd\ufffd\u000ey\ufffd:W\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\u07edH\ufffd\ufffd_$\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "www.blacklistip.com", "port": 7132, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd`\u07e1\u0174St[\u00df\ufffdZ\ufffd\ufffdxr'\ufffd^\ufffdsc#\ufffd8\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd;S\ufffd\r\ufffd\ufffdy\ufffd:W\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\u07edH\ufffd\ufffd_$\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd{www.blackli", "attack_vector": "postgres probe \u00b7 via TLS:7132 \u00b7 (sonde \/ probe)", "target_port_label": "7132 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7132, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd`\u07e1\u0174St[\u000f\u00df\ufffdZ\u0019\ufffd\ufffdxr'\ufffd\u0018^\ufffdsc\u0015#\ufffd8\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd;S\u0018\ufffd\r\ufffd\ufffd\u000ey\ufffd:W\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\u07edH\ufffd\ufffd_$\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "www.blacklistip.com", "port": 7132, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:7132 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd`\u07e1\u0174St[\u00df\ufffdZ\ufffd\ufffdxr'\ufffd^\ufffdsc#\ufffd8\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd;S\ufffd\r\ufffd\ufffdy\ufffd:W\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\u07edH\ufffd\ufffd_$\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd{www.blackli", "target_port_label": "7132 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7132" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3" ] }
06/08/2026 22:13:35 UTC	TCP	8117 · TLS	tls	Sonde TLS tls probe · via TLS:8117 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 1a9876192801f5c8 SNI ip-62-3-50-33.v4.isp.servpersosystems.net Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI ip-62-3-50-33.v4.isp.servpersosystems.net Capteur paris-1
Preuve / Evidence Méthode — Port 8117 Chemin / cible — Service TLS SNI TLS ip-62-3-50-33.v4.isp.servpersosystems.net Payload lh�l�`��9m��ި�ee�j�1N5�M��:Zi� ��$�J��ժu8xڈ��(�L�}Z5� �+�/�,�0̨̩��/5�� Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) lh�l�`��9m��ި�ee�j�1N5�M��:Zi� ��$�J��ժu8xڈ��(�L�}Z5� �+�/�,�0̨̩��/5�� Requête brute (extrait) lh�l�`��9m��ި�ee�j�1N5�M��:Zi� ��$�J��ժu8xڈ��(�L�}Z5� *�+�/�,�0̨̩��/5�� s��S��ʹ�8(�z?��=n�C��/�d�`�y�o��B��F��ЛǱ�E�这��a�¡p�5\|rY��(�h�j��\|��nItἥ��y%Z�8r�� czf}�E Meta JSON brut { "tls_ja3_hash": "1a9876192801f5c8cc19aca873d5d88c", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 625, "payload_entropy": 7.028138039941468, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 8117, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "63c1b55cab0045196e9967b14e016d121426c920", "event_fingerprint": "c9979545ae84a3b78ccb5c65cc2af806a782f2bb", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "1a9876192801f5c8cc19aca873d5d88c", "payload_hash": "9964c613bb9278415faa0f6fa57549da", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net" }, "target_context": { "dst_port": 8117, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002l\u0001\u0000\u0002h\u0003\u0003\ufffdl\ufffd`\ufffd\ufffd9m\ufffd\ufffd\u07a8\ufffdee\ufffdj\ufffd\u0010\u00131N5\ufffdM\ufffd\ufffd\ufffd:Zi\ufffd \ufffd\ufffd$\ufffdJ\u0004\u001e\ufffd\ufffd\ufffd\ufffd\u056au8\u001cx\u0688\ufffd\ufffd\u0018(\u000f\ufffdL\ufffd}Z5\ufffd\u0000 \u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u001a\u001a\u0000\u0000\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002l\u0001\u0000\u0002h\u0003\u0003\ufffdl\ufffd`\ufffd\ufffd9m\ufffd\ufffd\u07a8\ufffdee\ufffdj\ufffd\u0010\u00131N5\ufffdM\ufffd\ufffd\ufffd:Zi\ufffd \ufffd\ufffd$\ufffdJ\u0004\u001e\ufffd\ufffd\ufffd\ufffd\u056au8\u001cx\u0688\ufffd\ufffd\u0018(\u000f\ufffdL\ufffd}Z5\ufffd\u0000 *\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u001a\u001a\u0000\u0000\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001\u001d\u0000 \ufffds\ufffd\ufffdS\ufffd\ufffd\ufffd\u02b9\ufffd8(\ufffdz\u000f?\ufffd\ufffd=n\u0002\ufffdC\u0016\ufffd\u0006\ufffd\/\ufffdd\u0000\ufffd`\ufffdy\ufffdo\ufffd\ufffdB\ufffd\ufffd\u0005F\ufffd\ufffd\ufffd\ufffd\u041b\u01f1\ufffd\u001fE\ufffd\u8fd9\ufffd\ufffda\ufffd\u00a1p\ufffd5\|rY\ufffd\ufffd\u0006\ufffd\ufffd(\ufffdh\u0003\ufffdj\u000f\ufffd\u0003\ufffd\ufffd\ufffd\|\ufffd\ufffd\ufffd\ufffd\u001dnIt\u1f25\ufffd\ufffdy\u001d%Z\ufffd8r\ufffd\u001e\ufffd\u001d\r\ufffdczf}\ufffdE", "payload_snippet": "\u0016\u0003\u0001\u0002l\u0001\u0000\u0002h\u0003\u0003\ufffdl\ufffd`\ufffd\ufffd9m\ufffd\ufffd\u07a8\ufffdee\ufffdj\ufffd\u0010\u00131N5\ufffdM\ufffd\ufffd\ufffd:Zi\ufffd \ufffd\ufffd$\ufffdJ\u0004\u001e\ufffd\ufffd\ufffd\ufffd\u056au8\u001cx\u0688\ufffd\ufffd\u0018(\u000f\ufffdL\ufffd}Z5\ufffd\u0000 \u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u001a\u001a\u0000\u0000\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad726e5502ea673d65213f27cc4877885082fd28", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002l\u0001\u0000\u0002h\u0003\u0003\ufffdl\ufffd`\ufffd\ufffd9m\ufffd\ufffd\u07a8\ufffdee\ufffdj\ufffd\u0010\u00131N5\ufffdM\ufffd\ufffd\ufffd:Zi\ufffd \ufffd\ufffd$\ufffdJ\u0004\u001e\ufffd\ufffd\ufffd\ufffd\u056au8\u001cx\u0688\ufffd\ufffd\u0018(\u000f\ufffdL\ufffd}Z5\ufffd\u0000 *\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u001a\u001a\u0000\u0000\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001", "tls_ja3": "1a9876192801f5c8cc19aca873d5d88c", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 8117, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "lh\ufffdl\ufffd`\ufffd\ufffd9m\ufffd\ufffd\u07a8\ufffdee\ufffdj\ufffd1N5\ufffdM\ufffd\ufffd\ufffd:Zi\ufffd \ufffd\ufffd$\ufffdJ\ufffd\ufffd\ufffd\ufffd\u056au8x\u0688\ufffd\ufffd(\ufffdL\ufffd}Z5\ufffd *\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd", "attack_vector": "tls probe \u00b7 via TLS:8117 \u00b7 (sonde \/ probe)", "target_port_label": "8117 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8117, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002l\u0001\u0000\u0002h\u0003\u0003\ufffdl\ufffd`\ufffd\ufffd9m\ufffd\ufffd\u07a8\ufffdee\ufffdj\ufffd\u0010\u00131N5\ufffdM\ufffd\ufffd\ufffd:Zi\ufffd \ufffd\ufffd$\ufffdJ\u0004\u001e\ufffd\ufffd\ufffd\ufffd\u056au8\u001cx\u0688\ufffd\ufffd\u0018(\u000f\ufffdL\ufffd}Z5\ufffd\u0000 *\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u001a\u001a\u0000\u0000\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001", "tls_ja3": "1a9876192801f5c8cc19aca873d5d88c", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 8117, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:8117 \u00b7 (sonde \/ probe)", "evidence_snippet": "lh\ufffdl\ufffd`\ufffd\ufffd9m\ufffd\ufffd\u07a8\ufffdee\ufffdj\ufffd1N5\ufffdM\ufffd\ufffd\ufffd:Zi\ufffd \ufffd\ufffd$\ufffdJ\ufffd\ufffd\ufffd\ufffd\u056au8x\u0688\ufffd\ufffd(\ufffdL\ufffd}Z5\ufffd **\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd", "target_port_label": "8117 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8117" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }
06/08/2026 22:13:33 UTC	TCP	8117 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:8117 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8117 Chemin / cible — Service TLS Payload ��s1��&A�h��FQ��s�m�i'� ��(�I��-�@qA��=�Qhس��+�/�,�0̨̩� �� _ � Pourquoi cette classification :* Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��s1��&A�h��FQ��s�m�i'� ��(�I��-�@qA��=�Qhس��+�/�,�0̨̩� �� _� Requête brute (extrait) ��s1��&A�h��FQ��s�m�i'� ��(�I��-�@qA��=�Qhس��+�/�,�0̨̩� �� _ � � 2+ 3���d��\|\|ӱ%3)y�F��J Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.717102112141489, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 8117, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "b8054056ce262be9cf3d61640ba43ee7fc7f6f73", "event_fingerprint": "a737086262032a5fa6b23eb845e2d59a5aea5a33", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "a2513e7f7ef38ade9d6ee52d84dc7657", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 8117, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003s1\ufffd\ufffd\ufffd\ufffd&A\ufffdh\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\ufffdFQ\ufffd\ufffd\ufffds\ufffdm\ufffdi'\ufffd \ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd(\ufffdI\ufffd\u001c\ufffd-\ufffd@qA\ufffd\u000f\ufffd\ufffd=\ufffd\u0007Qh\u0633\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003s1\ufffd\ufffd\ufffd\ufffd&A\ufffdh\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\ufffdFQ\ufffd\ufffd\ufffds\ufffdm\ufffdi'\ufffd \ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd(\ufffdI\ufffd\u001c\ufffd-\ufffd@qA\ufffd\u000f\ufffd\ufffd=\ufffd\u0007Qh\u0633\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffd\ufffd\u0013\u0007\|\u001f\|\u04f1%3)y\ufffdF\ufffd\ufffd\ufffdJ", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003s1\ufffd\ufffd\ufffd\ufffd&A\ufffdh\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\ufffdFQ\ufffd\ufffd\ufffds\ufffdm\ufffdi'\ufffd \ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd(\ufffdI\ufffd\u001c\ufffd-\ufffd@qA\ufffd\u000f\ufffd\ufffd=\ufffd\u0007Qh\u0633\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0f8e8b5f4c1c05a2b09485294c761df8871ca95c", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003s1\ufffd\ufffd\ufffd\ufffd&A\ufffdh\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\ufffdFQ\ufffd\ufffd\ufffds\ufffdm\ufffdi'\ufffd \ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd(\ufffdI\ufffd\u001c\ufffd-\ufffd@qA\ufffd\u000f\ufffd\ufffd=\ufffd\u0007Qh\u0633\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 8117, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffds1\ufffd\ufffd\ufffd\ufffd&A\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdFQ\ufffd\ufffd\ufffds\ufffdm\ufffdi'\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffdI\ufffd\ufffd-\ufffd@qA\ufffd\ufffd\ufffd=\ufffdQh\u0633\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:8117 \u00b7 (sonde \/ probe)", "target_port_label": "8117 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8117, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003s1\ufffd\ufffd\ufffd\ufffd&A\ufffdh\ufffd\ufffd\ufffd\u000f\ufffd\ufffd\ufffdFQ\ufffd\ufffd\ufffds\ufffdm\ufffdi'\ufffd \ufffd\ufffd\u0000\ufffd\ufffd\ufffd\ufffd(\ufffdI\ufffd\u001c\ufffd-\ufffd@qA\ufffd\u000f\ufffd\ufffd=\ufffd\u0007Qh\u0633\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 8117, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:8117 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffds1\ufffd\ufffd\ufffd\ufffd&A\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdFQ\ufffd\ufffd\ufffds*\ufffdm\ufffdi'\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\ufffd(\ufffdI\ufffd\ufffd-\ufffd@qA\ufffd\ufffd\ufffd=\ufffdQh\u0633\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "8117 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8117" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
06/08/2026 21:33:27 UTC	TCP	18089 · TLS	tls	Sonde TLS tls probe · via TLS:18089 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 bc0d8bcf097ce655 SNI ip-62-3-50-33.v4.isp.servpersosystems.net Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI ip-62-3-50-33.v4.isp.servpersosystems.net Capteur paris-1
Preuve / Evidence Méthode — Port 18089 Chemin / cible — Service TLS SNI TLS ip-62-3-50-33.v4.isp.servpersosystems.net Payload ,(��pG��� I%�i�\�� Y�� y�P�t��׸4Qp��?��O%�`�� +�/�,�0̨̩��/5�ZZ� � Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ,(��pG��� I%�i�\�� Y�� y�P�t��׸4Qp��?��O%�`�� +�/�,�0̨̩��/5�ZZ� � Requête brute (extrait) ,(��pG��� I%�i�\�� Y�� y�P�t��׸4Qp��?��O%�`�� +�/�,�0̨̩��/5�ZZ� � �&�4��W�:%S\|�_ ?�\|��f6\��B3$�d��X<]d��f�P\| x@v�sD/� �C.��f�t)-��R? �u\D��)�Ѣ�<�m�u��/ i�h� Meta JSON brut { "tls_ja3_hash": "bc0d8bcf097ce6550a54736d8c65fe83", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 561, "payload_entropy": 6.801828341593844, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 18089, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "36188367d48ed96ca1e13ab5ee4cfaee45f59df9", "event_fingerprint": "aa0e25ee6bb0ef2c1d58d11cf4d65b1207bd16ef", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "bc0d8bcf097ce6550a54736d8c65fe83", "payload_hash": "e9230e9ee7bdf6152e3f9d57691fd00a", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net" }, "target_context": { "dst_port": 18089, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002,\u0001\u0000\u0002(\u0003\u0003\ufffd\ufffd\ufffdp\u0004G\ufffd\ue4b5\u001e\ufffd\ufffd\u0002\ufffd\n\ufffdI%\ufffd\u0002i\ufffd\\\ufffd\ufffd\rY\ufffd\u0017\u0017\ufffd y\ufffdP\ufffdt\ufffd\u000e\ufffd\u05f84\u0000\u001eQp\ufffd\ufffd?\ufffd\u0006\ufffdO%\ufffd`\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdZZ\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002,\u0001\u0000\u0002(\u0003\u0003\ufffd\ufffd\ufffdp\u0004G\ufffd\ue4b5\u001e\ufffd\ufffd\u0002\ufffd\n\ufffdI%\ufffd\u0002i\ufffd\\\ufffd\ufffd\rY\ufffd\u0017\u0017\ufffd y\ufffdP\ufffdt\ufffd\u000e\ufffd\u05f84\u0000\u001eQp\ufffd\ufffd?\ufffd\u0006\ufffdO%\ufffd`\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdZZ\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\u0000\u0000 \ufffd&\ufffd4\ufffd\ufffdW\ufffd\u0013:%S\u001b\|\ufffd_\u000b\u0003?\ufffd\|\u001c\ufffd\ufffd\u0018\ufffd\ufffd\bf6\\\u0000\ufffd\ufffd\ufffd\u0001\ufffd\ufffd\ufffd\ufffd\u0006B3$\u001b\u001a\ufffdd\ufffd\u0011\ufffd\ufffdX<]d\ufffd\ufffdf\ufffdP\| x@v\ufffdsD\/\u0015\ufffd\u0019\n\ufffdC.\ufffd\ufffd\ufffdf\ufffdt)-\ufffd\u0014\ufffd\ufffd\ufffdR?\u000b\ufffdu\\D\ufffd\ufffd\ufffd)\ufffd\u000f\u0462\ufffd<\ufffdm\ufffd\u000e\u0018\u0011u\ufffd\ufffd\u0012\ufffd\/\u000bi\ufffdh\ufffd\u0003", "payload_snippet": "\u0016\u0003\u0001\u0002,\u0001\u0000\u0002(\u0003\u0003\ufffd\ufffd\ufffdp\u0004G\ufffd\ue4b5\u001e\ufffd\ufffd\u0002\ufffd\n\ufffdI%\ufffd\u0002i\ufffd\\\ufffd\ufffd\rY\ufffd\u0017\u0017\ufffd y\ufffdP\ufffdt\ufffd\u000e\ufffd\u05f84\u0000\u001eQp\ufffd\ufffd?\ufffd\u0006\ufffdO%\ufffd`\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdZZ\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f3c378054f8aa4e739c27d93f804538d31ab950f", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002,\u0001\u0000\u0002(\u0003\u0003\ufffd\ufffd\ufffdp\u0004G\ufffd\ue4b5\u001e\ufffd\ufffd\u0002\ufffd\n\ufffdI%\ufffd\u0002i\ufffd\\\ufffd\ufffd\rY\ufffd\u0017\u0017\ufffd y\ufffdP\ufffdt\ufffd\u000e\ufffd\u05f84\u0000\u001eQp\ufffd\ufffd?\ufffd\u0006\ufffdO%\ufffd`\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdZZ\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\u0000", "tls_ja3": "bc0d8bcf097ce6550a54736d8c65fe83", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 18089, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": ",(\ufffd\ufffd\ufffdpG\ufffd\ue4b5\ufffd\ufffd\ufffd\n\ufffdI%\ufffdi\ufffd\\\ufffd\ufffd\rY\ufffd\ufffd y\ufffdP\ufffdt\ufffd\ufffd\u05f84Qp\ufffd\ufffd?\ufffd\ufffdO%\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdZZ\ufffd\r\ufffd", "attack_vector": "tls probe \u00b7 via TLS:18089 \u00b7 (sonde \/ probe)", "target_port_label": "18089 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 18089, "protocol_emulated": null, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002,\u0001\u0000\u0002(\u0003\u0003\ufffd\ufffd\ufffdp\u0004G\ufffd\ue4b5\u001e\ufffd\ufffd\u0002\ufffd\n\ufffdI%\ufffd\u0002i\ufffd\\\ufffd\ufffd\rY\ufffd\u0017\u0017\ufffd y\ufffdP\ufffdt\ufffd\u000e\ufffd\u05f84\u0000\u001eQp\ufffd\ufffd?\ufffd\u0006\ufffdO%\ufffd`\ufffd\ufffd\ufffd\u0010\ufffd\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdZZ\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\u0000", "tls_ja3": "bc0d8bcf097ce6550a54736d8c65fe83", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 18089, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:18089 \u00b7 (sonde \/ probe)", "evidence_snippet": ",(\ufffd\ufffd\ufffdpG\ufffd\ue4b5\ufffd\ufffd\ufffd\n\ufffdI%\ufffdi\ufffd\\\ufffd\ufffd\rY\ufffd\ufffd y\ufffdP\ufffdt\ufffd\ufffd\u05f84Qp\ufffd\ufffd?\ufffd\ufffdO%\ufffd`\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdZZ\ufffd\r\ufffd", "target_port_label": "18089 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "18089" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }
06/08/2026 21:33:25 UTC	TCP	18089 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:18089 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 20b279993ae2e137 SNI ip-62-3-50-33.v4.isp.servpersosystems.net Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 Cible HTTP — TLS SNI ip-62-3-50-33.v4.isp.servpersosystems.net Capteur paris-1
Preuve / Evidence Méthode — Port 18089 Chemin / cible — Service TLS SNI TLS ip-62-3-50-33.v4.isp.servpersosystems.net Payload ��ޒ[ ��,�:ς�f� �;��^��C�D �G��Å�r�k̺h�%r5`�l6�>`��Z�+�/�,�0̨̩� �� .,)ip-62-3-50- Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��ޒ[ ��,�:ς�f��;��^��C�D �G��Å�r�k̺h�%r5`�l6�>`��Z�+�/�,�0̨̩� �� .,)ip-62-3-50- Requête brute (extrait) ��ޒ[ ��,�:ς�f� �;��^��C�D �G��Å�r�k̺h�%r5`�l6�>`��Z�+�/�,�0̨̩� �� .,)ip-62-3-50-33.v4.isp.servpersosystems.net � � 2 Meta JSON brut { "tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "bytes_in": 1533, "payload_entropy": 7.74110904972346, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 18089, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "a94f4420a2c34bec15a89c7806e5fe3bd2efa78d", "event_fingerprint": "5dc1f9bcde6deaf9eb067506ad46818dffecf821", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "20b279993ae2e137e62b9647c6d768fb", "payload_hash": "93792b2e97254f155b613109cfef1c0a", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net" }, "target_context": { "dst_port": 18089, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0792[\r\ufffd\ufffd\u0013\ufffd\ufffd,\ufffd:\u03c2\ufffd\u0012f\ufffd\f\ufffd;\ufffd\ufffd^\ufffd\u001e\ufffdC\u0010\ufffdD \ufffd\u0014G\ufffd\ufffd\u00c5\ufffdr\ufffdk\u033a\u0017h\ufffd%r5`\ufffdl6\ufffd>`\ufffd\ufffd\ufffd\ufffdZ\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0792[\r\ufffd\ufffd\u0013\ufffd\ufffd,\ufffd:\u03c2\ufffd\u0012f\ufffd\f\ufffd;\ufffd\ufffd^\ufffd\u001e\ufffdC\u0010\ufffdD \ufffd\u0014G\ufffd\ufffd\u00c5\ufffdr\ufffdk\u033a\u0017h\ufffd%r5`\ufffdl6\ufffd>`\ufffd\ufffd\ufffd\ufffdZ\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-33.v4.isp.servpersosystems.net\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0792[\r\ufffd\ufffd\u0013\ufffd\ufffd,\ufffd:\u03c2\ufffd\u0012f\ufffd\f\ufffd;\ufffd\ufffd^\ufffd\u001e\ufffdC\u0010\ufffdD \ufffd\u0014G\ufffd\ufffd\u00c5\ufffdr\ufffdk\u033a\u0017h\ufffd%r5`\ufffdl6\ufffd>`\ufffd\ufffd\ufffd\ufffdZ\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5dd5d24b9a4a7c66353e2015124b855086676b50", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0792[\r\ufffd\ufffd\u0013\ufffd\ufffd,\ufffd:\u03c2\ufffd\u0012f\ufffd\f\ufffd;\ufffd\ufffd^\ufffd\u001e\ufffdC\u0010\ufffdD \ufffd\u0014G\ufffd\ufffd\u00c5\ufffdr\ufffdk\u033a\u0017h\ufffd%r5`\ufffdl6\ufffd>`\ufffd\ufffd\ufffd\ufffdZ\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 18089, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\u0792[\r\ufffd\ufffd\ufffd\ufffd,\ufffd:\u03c2\ufffdf\ufffd\ufffd;\ufffd\ufffd^\ufffd\ufffdC\ufffdD \ufffdG\ufffd\ufffd\u00c5\ufffdr\ufffdk\u033ah\ufffd%r5`\ufffdl6\ufffd>`\ufffd\ufffd\ufffd\ufffdZ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd.,)ip-62-3-50-", "attack_vector": "postgres probe \u00b7 via TLS:18089 \u00b7 (sonde \/ probe)", "target_port_label": "18089 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 18089, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\u0792[\r\ufffd\ufffd\u0013\ufffd\ufffd,\ufffd:\u03c2\ufffd\u0012f\ufffd\f\ufffd;\ufffd\ufffd^\ufffd\u001e\ufffdC\u0010\ufffdD \ufffd\u0014G\ufffd\ufffd\u00c5\ufffdr\ufffdk\u033a\u0017h\ufffd%r5`\ufffdl6\ufffd>`\ufffd\ufffd\ufffd\ufffdZ\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 18089, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:18089 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u0792[\r\ufffd\ufffd\ufffd\ufffd,\ufffd:\u03c2\ufffdf\ufffd\ufffd;\ufffd\ufffd^\ufffd\ufffdC\ufffdD \ufffdG\ufffd\ufffd\u00c5\ufffdr\ufffdk\u033ah\ufffd%r5`\ufffdl6\ufffd>`\ufffd\ufffd\ufffd\ufffdZ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd.,)ip-62-3-50-", "target_port_label": "18089 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "18089" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3" ] }
06/08/2026 21:02:24 UTC	TCP	15800 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:15800 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 20b279993ae2e137 SNI blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 Cible HTTP — TLS SNI blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 15800 Chemin / cible — Service TLS SNI TLS blacklistip.com Payload ��,�OxoV�$��6e�eVv-ʿW;�k�U=� avvRF�B��wdrKڗ�#%�@n��+�/�,�0̨̩� �� wblacklistip Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��,�OxoV�$��6e�eVv-ʿW;�k�U=� avvRF�B��wdrKڗ�#%�@n��+�/�,�0̨̩� �� wblacklistip Requête brute (extrait) ��,�OxoV�$��6e�eVv-ʿW;�k�U=� avvRF�B��wdrKڗ�#%�@n��+�/�,�0̨̩� �� wblacklistip.com � � 2+ 3��c Meta JSON brut { "tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "blacklistip.com", "bytes_in": 1507, "payload_entropy": 7.743255663677385, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 15800, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "1c905461fa0444c2eb1bf3f7720321eb916a0c9a", "event_fingerprint": "0471bdd3918c78d9fddfe46550214a7ade193ee3", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "20b279993ae2e137e62b9647c6d768fb", "payload_hash": "fc636c0ccbcc01f5c9ace9238439eb31", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "tls_sni": "blacklistip.com" }, "target_context": { "dst_port": 15800, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003,\ufffdOx\u0014oV\ufffd$\ufffd\u0001\ufffd6e\ufffdeVv-\u02bfW;\ufffd\u0019k\ufffd\u0001\u0007U=\ufffd avv\u0006R\u0005F\ufffdB\ufffd\ufffd\ufffdwdrK\u0697\ufffd#%\ufffd@n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003,\ufffdOx\u0014oV\ufffd$\ufffd\u0001\ufffd6e\ufffdeVv-\u02bfW;\ufffd\u0019k\ufffd\u0001\u0007U=\ufffd avv\u0006R\u0005F\ufffdB\ufffd\ufffd\ufffdwdrK\u0697\ufffd#%\ufffd@n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip.com\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffdc", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003,\ufffdOx\u0014oV\ufffd$\ufffd\u0001\ufffd6e\ufffdeVv-\u02bfW;\ufffd\u0019k\ufffd\u0001\u0007U=\ufffd avv\u0006R\u0005F\ufffdB\ufffd\ufffd\ufffdwdrK\u0697\ufffd#%\ufffd@n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "80d637c3748e5ef91f4defd522e31d4e3b625ec9", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003,\ufffdOx\u0014oV\ufffd$\ufffd\u0001\ufffd6e\ufffdeVv-\u02bfW;\ufffd\u0019k\ufffd\u0001\u0007U=\ufffd avv\u0006R\u0005F\ufffdB\ufffd\ufffd\ufffdwdrK\u0697\ufffd#%\ufffd@n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "blacklistip.com", "port": 15800, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd,\ufffdOxoV\ufffd$\ufffd\ufffd6e\ufffdeVv-\u02bfW;\ufffdk\ufffdU=\ufffd avvRF\ufffdB\ufffd\ufffd\ufffdwdrK\u0697\ufffd#%\ufffd@n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdwblacklistip", "attack_vector": "postgres probe \u00b7 via TLS:15800 \u00b7 (sonde \/ probe)", "target_port_label": "15800 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 15800, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003,\ufffdOx\u0014oV\ufffd$\ufffd\u0001\ufffd6e\ufffdeVv-\u02bfW;\ufffd\u0019k\ufffd\u0001\u0007U=\ufffd avv\u0006R\u0005F\ufffdB\ufffd\ufffd\ufffdwdrK\u0697\ufffd#%\ufffd@n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "blacklistip.com", "port": 15800, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:15800 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd,\ufffdOxoV\ufffd$\ufffd\ufffd6e\ufffdeVv-\u02bfW;\ufffdk\ufffdU=\ufffd avvRF\ufffdB\ufffd\ufffd\ufffdwdrK\u0697\ufffd#%\ufffd@n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdwblacklistip", "target_port_label": "15800 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "15800" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3" ] }
06/08/2026 20:24:59 UTC	TCP	30003 · TLS	tls	Sonde Kafka kafka probe · via TLS:30003 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 23a20d1c0f553015 SNI blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 30003 Chemin / cible — Service TLS SNI TLS blacklistip.com Payload ��pn�pV��Vq�w�5a�\|g[u�M\|8 �`��5q��_��6Em�<�}r�fN�4@؆�\| JJ�+�/�,�0̨̩��/5�ZZ� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key Sybase TDS login STUN binding Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��pn�pV��Vq�w�5a�\|g[u�M\|8 �`��5q��_��6Em�<�}r�fN�4@؆�\| JJ�+�/�,�0̨̩��/5�ZZ� Requête brute (extrait) ��pn�pV��Vq�w�5a�\|g[u�M\|8 �`��5q��_��6Em�<�}r�fN�4@؆�\| JJ�+�/�,�0̨̩��/5�ZZ� ��blacklistip.com 3+)�� _��7�K~��a,��)�Ёt�;r,��D#Dih2 Meta JSON brut { "tls_ja3_hash": "23a20d1c0f55301584704102170c37c6", "tls_sni": "blacklistip.com", "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 503, "payload_entropy": 6.791266478208931, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 30003, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 32, "tag_count": 2, "anomaly_count": 0, "campaign_key": "37d0794bfb5aee3903df654bcdb363b055cef4c0", "event_fingerprint": "56ab48237989b74d821261b803cad0c8573cfec0", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0607", "pat-0771", "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "Sybase TDS login", "STUN binding", "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0607", "pat-0771", "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "23a20d1c0f55301584704102170c37c6", "payload_hash": "29bc2ebb0d45a4fb7af33573b8cd2e1f", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13", "tls_sni": "blacklistip.com" }, "target_context": { "dst_port": 30003, "service": "tls", "service_name": "tls", "risk_score": 32 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0013\u0001\ufffdpn\ufffd\u0007pV\ufffd\ufffdVq\ufffd\u0011w\ufffd5a\ufffd\|g[u\ufffdM\u0015\|8 \ufffd`\ufffd\ufffd\ufffd5q\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd6Em\ufffd<\ufffd}r\ufffdfN\ufffd4@\u0606\ufffd\|\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdZZ\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0013\u0001\ufffdpn\ufffd\u0007pV\ufffd\ufffdVq\ufffd\u0011w\ufffd5a\ufffd\|g[u\ufffdM\u0015\|8 \ufffd`\ufffd\ufffd\ufffd5q\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd6Em\ufffd<\ufffd}r\ufffdfN\ufffd4@\u0606\ufffd\|\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdZZ\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip.com\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 \ufffd\ufffd_\ufffd\ufffd\ufffd7\ufffdK~\ufffd\ufffd\ufffd\u0005a,\ufffd\ufffd\ufffd)\ufffd\u0401t\ufffd;r,\ufffd\ufffdD\u0000#\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0017\u0000\u0000\u0000\u0005", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0013\u0001\ufffdpn\ufffd\u0007pV\ufffd\ufffdVq\ufffd\u0011w\ufffd5a\ufffd\|g[u\ufffdM\u0015\|8 \ufffd`\ufffd\ufffd\ufffd5q\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd6Em\ufffd<\ufffd}r\ufffdfN\ufffd4@\u0606\ufffd\|\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdZZ\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8d56e019b8b1950995065ffc890fdb465afb9d15", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0013\u0001\ufffdpn\ufffd\u0007pV\ufffd\ufffdVq\ufffd\u0011w\ufffd5a\ufffd\|g[u\ufffdM\u0015\|8 \ufffd`\ufffd\ufffd\ufffd5q\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd6Em\ufffd<\ufffd}r\ufffdfN\ufffd4@\u0606\ufffd\|\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdZZ\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000", "tls_ja3": "23a20d1c0f55301584704102170c37c6", "tls_sni": "blacklistip.com", "port": 30003, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdpn\ufffdpV\ufffd\ufffdVq\ufffdw\ufffd5a\ufffd\|g[u\ufffdM\|8 \ufffd`\ufffd\ufffd\ufffd5q\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd6Em\ufffd<\ufffd}r\ufffdfN\ufffd4@\u0606\ufffd\| JJ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdZZ\ufffd", "attack_vector": "kafka probe \u00b7 via TLS:30003 \u00b7 (sonde \/ probe)", "target_port_label": "30003 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 30003, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\u0013\u0001\ufffdpn\ufffd\u0007pV\ufffd\ufffdVq\ufffd\u0011w\ufffd5a\ufffd\|g[u\ufffdM\u0015\|8 \ufffd`\ufffd\ufffd\ufffd5q\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd6Em\ufffd<\ufffd}r\ufffdfN\ufffd4@\u0606\ufffd\|\u0000 JJ\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdZZ\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000", "tls_ja3": "23a20d1c0f55301584704102170c37c6", "tls_sni": "blacklistip.com", "port": 30003, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "kafka probe \u00b7 via TLS:30003 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdpn\ufffdpV\ufffd\ufffdVq\ufffdw\ufffd5a\ufffd\|g[u\ufffdM\|8 \ufffd`\ufffd\ufffd\ufffd5q\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd6Em\ufffd<\ufffd}r\ufffdfN\ufffd4@\u0606\ufffd\| JJ\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdZZ\ufffd", "target_port_label": "30003 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "30003" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }
06/08/2026 20:22:02 UTC	TCP	12426 · TLS	tls	dnp3 probe dnp3 probe · via TLS:12426 · (sonde / probe)	Élevée	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 240949e5403b9589 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 12426 Chemin / cible — Service TLS Payload ��kq��LD�D��F@I� ^7�:6}$�� '��}�q��4N�j��\�� +�/�,�0̨̩��/5m��Dih2 Pourquoi cette classification : Type « dnp3_probe » (signaux protocolaires) · confiance 51% Confiance classification 51% Risque capteur Faible · 33 Confiance : Confiance 51 % — Motif catalogue confirmé Signaux pat-0794 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Sigma DNP3 link Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��kq��LD�D��F@I� ^7�:6}$�� '��}�q��4N�j��\�� +�/�,�0̨̩��/5m��Dih2 Requête brute (extrait) ��kq��LD�D��F@I� ^7�:6}$�� '��}�q��4N�j��\�� +�/�,�0̨̩��/5m��Dih2� �6 ntOw̱apf4��t͕)��BS!�L86M��\X��7x?��]��1Cd�� \ ��n� 夞5��@ڛg��׀�pֵ�a Meta JSON brut { "tls_ja3_hash": "240949e5403b95896c931836fc24892a", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 479, "payload_entropy": 6.774358388999211, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 12426, "risk_waf": 8, "risk_classification": 58, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 33, "tag_count": 3, "anomaly_count": 0, "campaign_key": "a735f72067fa584b973040fb29d8c4fcc96d9b03", "event_fingerprint": "2464c42e36c4ea5fe9aaaf108814a1a75781674c", "classification_reason": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%", "confidence": 0.51, "classification_confidence": 0.51, "precision_score": 60, "precision_signals": [ "pat-0794" ], "kb_rule_ids": [ "pat-0794" ], "matched_patterns": [ "pat-0794", "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Sigma DNP3 link", "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0794", "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 33 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 51, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "240949e5403b95896c931836fc24892a", "payload_hash": "053f1444f3be9359e4d54eff5e62b37e", "path_pattern_hash": "859b07b9d78548343d57aca7faf5fc6a" }, "target_context": { "dst_port": 12426, "service": "tls", "service_name": "tls", "risk_score": 33 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u000f\ufffdkq\ufffd\ufffdLD\ufffdD\ufffd\ufffd\ufffdF@I\ufffd\u0015 ^7\ufffd:6}$\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd'\ufffd\u001f\ufffd\u001f\ufffd\ufffd}\u001c\ufffdq\ufffd\u0019\ufffd\ufffd\u0007\ufffd\u00024N\ufffd\u0002j\ufffd\ufffd\\\ufffd\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m\ufffd\ufffd\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u000f\ufffdkq\ufffd\ufffdLD\ufffdD\ufffd\ufffd\ufffdF@I\ufffd\u0015 ^7\ufffd:6}$\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd'\ufffd\u001f\ufffd\u001f\ufffd\ufffd}\u001c\ufffdq\ufffd\u0019\ufffd\ufffd\u0007\ufffd\u00024N\ufffd\u0002j\ufffd\ufffd\\\ufffd\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m\ufffd\ufffd\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000\u001b\u0000\u0003\u0002\u0000\u0002\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u00016\u0000 ntOw\u0331apf4\ufffd\ufffdt\u000f\u0355)\ufffd\ufffdBS!\ufffdL8\u00056M\ufffd\ufffd\\X\u0000\ufffd\ufffd\ufffd\u001e7x?\ufffd\ufffd\ufffd\ufffd]\ufffd\u0006\ufffd\ufffd1C\u0005d\ufffd\ufffd\u000b\ufffd\t\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\ \ufffd\ufffd\ufffd\u001b\u001fn\u0018\ufffd\u0013\f\u591e5\ufffd\ufffd\u001b\ufffd\ufffd\ufffd\u0015\ufffd\ufffd@\u069bg\ufffd\ufffd\ufffd\u05c0\ufffdp\u000f\u05b5\u0014\ufffda", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u000f\ufffdkq\ufffd\ufffdLD\ufffdD\ufffd\ufffd\ufffdF@I\ufffd\u0015 ^7\ufffd:6}$\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd'\ufffd\u001f\ufffd\u001f\ufffd\ufffd}\u001c\ufffdq\ufffd\u0019\ufffd\ufffd\u0007\ufffd\u00024N\ufffd\u0002j\ufffd\ufffd\\\ufffd\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m\ufffd\ufffd\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000", "classification_reason": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "ics_probe" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "235b69ef177a47972889ac9c2baf04a8c60a29c2", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u000f\ufffdkq\ufffd\ufffdLD\ufffdD\ufffd\ufffd\ufffdF@I\ufffd\u0015 ^7\ufffd:6}$\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd'\ufffd\u001f\ufffd\u001f\ufffd\ufffd}\u001c\ufffdq\ufffd\u0019\ufffd\ufffd\u0007\ufffd\u00024N\ufffd\u0002j\ufffd\ufffd\\\ufffd\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m\ufffd\ufffd\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000", "tls_ja3": "240949e5403b95896c931836fc24892a", "port": 12426, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdkq\ufffd\ufffdLD\ufffdD\ufffd\ufffd\ufffdF@I\ufffd ^7\ufffd:6}$\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffd}\ufffdq\ufffd\ufffd\ufffd\ufffd4N\ufffdj\ufffd\ufffd\\\ufffd\ufffd\ufffd \n\n\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5m\ufffd\ufffdDih2", "attack_vector": "dnp3 probe \u00b7 via TLS:12426 \u00b7 (sonde \/ probe)", "target_port_label": "12426 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 51 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%", "classification_reason_label_fr": "Type \u00ab dnp3_probe \u00bb (signaux protocolaires) \u00b7 confiance 51%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100", "confidence_pct": 51, "confidence_breakdown": { "waf": 8, "classification": 58, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 33 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 33, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 12426, "protocol_emulated": null, "tags_summary": [ "pat-0794" ], "tags_summary_labels_fr": [ "pat-0794" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\u000f\ufffdkq\ufffd\ufffdLD\ufffdD\ufffd\ufffd\ufffdF@I\ufffd\u0015 ^7\ufffd:6}$\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd'\ufffd\u001f\ufffd\u001f\ufffd\ufffd}\u001c\ufffdq\ufffd\u0019\ufffd\ufffd\u0007\ufffd\u00024N\ufffd\u0002j\ufffd\ufffd\\\ufffd\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m\ufffd\ufffd\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000", "tls_ja3": "240949e5403b95896c931836fc24892a", "port": 12426, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "dnp3 probe \u00b7 via TLS:12426 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffdkq\ufffd\ufffdLD\ufffdD\ufffd\ufffd\ufffdF@I\ufffd ^7\ufffd:6}$\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd'\ufffd\ufffd\ufffd\ufffd}\ufffdq\ufffd\ufffd\ufffd\ufffd4N\ufffdj\ufffd\ufffd\\\ufffd\ufffd\ufffd \n\n\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5m\ufffd\ufffdDih2", "target_port_label": "12426 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 51 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 51 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "12426" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
06/08/2026 20:21:49 UTC	TCP	12426 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:12426 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 20b279993ae2e137 SNI ip-62-3-50-33.v4.isp.servpersosystems.net Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 Cible HTTP — TLS SNI ip-62-3-50-33.v4.isp.servpersosystems.net Capteur paris-1
Preuve / Evidence Méthode — Port 12426 Chemin / cible — Service TLS SNI TLS ip-62-3-50-33.v4.isp.servpersosystems.net Payload ��8�"- ��Gj�"l~X�裬�ލ.��6V�B� d�7�E��'#rX�{�R R��\|�ao�}�+�/�,�0̨̩� �� .,)ip-62-3-50- Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��8�"- ��Gj�"l~X�裬�ލ.��6V�B� d�7�E��'#rX�{�RR��\|�ao�}�+�/�,�0̨̩� �� .,)ip-62-3-50- Requête brute (extrait) ��8�"- ��Gj�"l~X�裬�ލ.��6V�B� d�7�E��'#rX�{�R R��\|�ao�}�+�/�,�0̨̩� �� .,)ip-62-3-50-33.v4.isp.servpersosystems.net � � 2 Meta JSON brut { "tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "bytes_in": 1533, "payload_entropy": 7.7444958467795715, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 12426, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "a9d157a9979e6d1feaf80cd72bff98b2088c2a5d", "event_fingerprint": "2ebe3dc89886026f104e0c117a7866046893e43f", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "20b279993ae2e137e62b9647c6d768fb", "payload_hash": "c2c1c5fec763379721a4a4e93a7f4ee1", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net" }, "target_context": { "dst_port": 12426, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00038\ufffd\"- \ufffd\ufffd\u0019G\u0017j\ufffd\"l~X\ufffd\u88ec\ufffd\u078d.\ufffd\ufffd6V\ufffd\u0002B\ufffd d\ufffd7\u0018\ufffd\u0013E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'#rX\ufffd{\ufffdR\fR\ufffd\ufffd\|\ufffdao\ufffd}\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00038\ufffd\"- \ufffd\ufffd\u0019G\u0017j\ufffd\"l~X\ufffd\u88ec\ufffd\u078d.\ufffd\ufffd6V\ufffd\u0002B\ufffd d\ufffd7\u0018\ufffd\u0013E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'#rX\ufffd{\ufffdR\fR\ufffd\ufffd\|\ufffdao\ufffd}\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-33.v4.isp.servpersosystems.net\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00038\ufffd\"- \ufffd\ufffd\u0019G\u0017j\ufffd\"l~X\ufffd\u88ec\ufffd\u078d.\ufffd\ufffd6V\ufffd\u0002B\ufffd d\ufffd7\u0018\ufffd\u0013E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'#rX\ufffd{\ufffdR\fR\ufffd\ufffd\|\ufffdao\ufffd}\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ce6296bc55cda5b32be6f9546026fb187ff59dda", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00038\ufffd\"- \ufffd\ufffd\u0019G\u0017j\ufffd\"l~X\ufffd\u88ec\ufffd\u078d.\ufffd\ufffd6V\ufffd\u0002B\ufffd d\ufffd7\u0018\ufffd\u0013E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'#rX\ufffd{\ufffdR\fR\ufffd\ufffd\|\ufffdao\ufffd}\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 12426, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd8\ufffd\"- \ufffd\ufffdGj\ufffd\"l~X\ufffd\u88ec\ufffd\u078d.\ufffd\ufffd6V\ufffdB\ufffd d\ufffd7\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'#rX\ufffd{\ufffdRR\ufffd\ufffd\|\ufffdao\ufffd}\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd.,)ip-62-3-50-", "attack_vector": "postgres probe \u00b7 via TLS:12426 \u00b7 (sonde \/ probe)", "target_port_label": "12426 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 12426, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00038\ufffd\"- \ufffd\ufffd\u0019G\u0017j\ufffd\"l~X\ufffd\u88ec\ufffd\u078d.\ufffd\ufffd6V\ufffd\u0002B\ufffd d\ufffd7\u0018\ufffd\u0013E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'#rX\ufffd{\ufffdR\fR\ufffd\ufffd\|\ufffdao\ufffd}\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 12426, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:12426 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd8\ufffd\"- \ufffd\ufffdGj\ufffd\"l~X\ufffd\u88ec\ufffd\u078d.\ufffd\ufffd6V\ufffdB\ufffd d\ufffd7\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'#rX\ufffd{\ufffdRR\ufffd\ufffd\|\ufffdao\ufffd}\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd.,)ip-62-3-50-", "target_port_label": "12426 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "12426" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3" ] }
06/08/2026 20:21:42 UTC	TCP	12426 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:12426 · (sonde / probe)	Moyenne	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 2196848d251b217d Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 12426 Chemin / cible — Service TLS Payload �� rY��0��yC�� eb/��nu{ ��,�׻��!.,Y��,��+��Q�8�4q��+�/�,�0̨̩� �� _ � Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �� rY��0��yC�� eb/��nu{ ��,�׻��!.,Y��,��+��Q�8�4q��+�/�,�0̨̩� �� _� Requête brute (extrait) �� rY��0��yC�� eb/��nu{ ��,�׻��!.,Y��,��+��Q�8�4q��+�/�,�0̨̩� �� _ � � 2+ 3��J S�S}ʨל!FR{(֡�� GZH Meta JSON brut { "tls_ja3_hash": "2196848d251b217de8b2c037e356c11d", "tls_sni": null, "bytes_in": 1483, "payload_entropy": 7.73210779103192, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 12426, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "7295b0205aa974b9c1825f7038950685ebeb9682", "event_fingerprint": "25205216323ef6f6643c4c7af540c10f6bb64a6b", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2196848d251b217de8b2c037e356c11d", "payload_hash": "a87056784f268b559c577b1df099c8c4", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 12426, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\r\ufffd\b\ufffd\ufffdrY\ufffd\ufffd0\ufffd\ufffdyC\u0000\ufffd\u001e\ufffd\ufffd\r\ufffdeb\/\ufffd\ufffd\ufffdnu\u0006{ \ufffd\ufffd,\ufffd\u05fb\ufffd\ufffd\ufffd!.,Y\ufffd\u0015\ufffd,\ufffd\ufffd+\ufffd\ufffd\ufffd\u0011Q\ufffd8\ufffd4q\ufffd\u0002\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\r\ufffd\b\ufffd\ufffdrY\ufffd\ufffd0\ufffd\ufffdyC\u0000\ufffd\u001e\ufffd\ufffd\r\ufffdeb\/\ufffd\ufffd\ufffdnu\u0006{ \ufffd\ufffd,\ufffd\u05fb\ufffd\ufffd\ufffd!.,Y\ufffd\u0015\ufffd,\ufffd\ufffd+\ufffd\ufffd\ufffd\u0011Q\ufffd8\ufffd4q\ufffd\u0002\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffdJ\tS\ufffdS}\u02a8\u05dc!FR{(\u05a1\ufffd\ufffd\fG\u0011ZH", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\r\ufffd\b\ufffd\ufffdrY\ufffd\ufffd0\ufffd\ufffdyC\u0000\ufffd\u001e\ufffd\ufffd\r\ufffdeb\/\ufffd\ufffd\ufffdnu\u0006{ \ufffd\ufffd,\ufffd\u05fb\ufffd\ufffd\ufffd!.,Y\ufffd\u0015\ufffd,\ufffd\ufffd+\ufffd\ufffd\ufffd\u0011Q\ufffd8\ufffd4q\ufffd\u0002\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6ef3cabfbe65899b789455918ce82db209270c06", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\r\ufffd\b\ufffd\ufffdrY\ufffd\ufffd0\ufffd\ufffdyC\u0000\ufffd\u001e\ufffd\ufffd\r\ufffdeb\/\ufffd\ufffd\ufffdnu\u0006{ \ufffd\ufffd,\ufffd\u05fb\ufffd\ufffd\ufffd!.,Y\ufffd\u0015\ufffd,\ufffd\ufffd+\ufffd\ufffd\ufffd\u0011Q\ufffd8\ufffd4q\ufffd\u0002\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 12426, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\r\ufffd\ufffd\ufffdrY\ufffd\ufffd0\ufffd\ufffdyC\ufffd\ufffd\ufffd\r\ufffdeb\/\ufffd\ufffd\ufffdnu{ \ufffd\ufffd,\ufffd\u05fb\ufffd\ufffd\ufffd!.,Y\ufffd\ufffd,\ufffd\ufffd+\ufffd\ufffd\ufffdQ\ufffd8\ufffd4q\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:12426 \u00b7 (sonde \/ probe)", "target_port_label": "12426 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 12426, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\r\ufffd\b\ufffd\ufffdrY\ufffd\ufffd0\ufffd\ufffdyC\u0000\ufffd\u001e\ufffd\ufffd\r\ufffdeb\/\ufffd\ufffd\ufffdnu\u0006{ \ufffd\ufffd,\ufffd\u05fb\ufffd\ufffd\ufffd!.,Y\ufffd\u0015\ufffd,\ufffd\ufffd+\ufffd\ufffd\ufffd\u0011Q\ufffd8\ufffd4q\ufffd\u0002\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005_\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "2196848d251b217de8b2c037e356c11d", "port": 12426, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:12426 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\r\ufffd\ufffd\ufffdrY\ufffd\ufffd0\ufffd\ufffdyC\ufffd\ufffd\ufffd\r\ufffdeb\/\ufffd\ufffd\ufffdnu{ \ufffd\ufffd,\ufffd\u05fb\ufffd\ufffd\ufffd!.,Y\ufffd\ufffd,\ufffd\ufffd+\ufffd\ufffd\ufffdQ\ufffd8\ufffd4q\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd_\ufffd", "target_port_label": "12426 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "12426" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni" ] }
06/08/2026 20:20:37 UTC	TCP	3021 · TLS	tls	Protocole TDS MSSQL mssql tds · via TLS:3021 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 fd11ecad046fc954 SNI blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 3021 Chemin / cible — Service TLS SNI TLS blacklistip.com Payload b�؞��?_K;��d�� h�q�7�^L��VA Y)�c��\g��:w7NV��`�h�� $�= ��+�/�,�0̨̩��/5�� Pourquoi cette classification :* Type « mssql_tds » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0519 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) MSSQL TDS prelogin Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) b�؞��?_K;��d�� h�q�7�^L��VA Y)�c��\g��:w7NV��`�h�� $�= ��+�/�,�0̨̩��/5�� Requête brute (extrait) b�؞��?_K;��d�� h�q�7�^L��VA Y)�c��\g��:w7NV��`�h�� $�= ��+�/�,�0̨̩��/5�� Tp�f3�HL��q7�Z�p�ߩ62x�F �?�W>U��9B�;J!U4�O�,zqb� f�;�G�� E�F��<�pшr��N�Y�y1�;PD��'�2<<M �F�f�;� Meta JSON brut { "tls_ja3_hash": "fd11ecad046fc95468d98e3409e4e8a5", "tls_sni": "blacklistip.com", "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 535, "payload_entropy": 6.904633340578493, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 3021, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 32, "tag_count": 2, "anomaly_count": 0, "campaign_key": "68ca62c79080ea7a059b2dd74eb9455455aeff87", "event_fingerprint": "5b2bfedf1d86e0401df7cc01d85bb3c45f42f76c", "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0519" ], "kb_rule_ids": [ "pat-0519" ], "matched_patterns": [ "pat-0519", "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "MSSQL TDS prelogin", "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0519", "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 32 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "fd11ecad046fc95468d98e3409e4e8a5", "payload_hash": "b8ae3f4356b62e5f64809be1b14f381a", "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2", "tls_sni": "blacklistip.com" }, "target_context": { "dst_port": 3021, "service": "tls", "service_name": "tls", "risk_score": 32 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0012\u0001\u0000\u0002\u000e\u0003\u0003b\ufffd\u061e\ufffd\ufffd?_K;\ufffd\ufffd\b\u0004\ufffd\ufffdd\ufffd\ufffd\nh\ufffdq\ufffd7\ufffd^L\ufffd\ufffdVA Y)\ufffdc\u0003\ufffd\ufffd\ufffd\\g\ufffd\ufffd:w7NV\ufffd\ufffd`\ufffdh\ufffd\u0015\ufffd\n$\u0018\ufffd=\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\r\u0000\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0012\u0001\u0000\u0002\u000e\u0003\u0003b\ufffd\u061e\ufffd\ufffd?_K;\ufffd\ufffd\b\u0004\ufffd\ufffdd\ufffd\ufffd\nh\ufffdq\ufffd7\ufffd^L\ufffd\ufffdVA Y)\ufffdc\u0003\ufffd\ufffd\ufffd\\g\ufffd\ufffd:w7NV\ufffd\ufffd`\ufffdh\ufffd\u0015\ufffd\n$\u0018\ufffd=\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\u000f\u0000 \u0012\ufffdTp\ufffd\u0011f3\ufffdHL\ufffd\u001a\ufffdq7\u0010\ufffdZ\ufffdp\ufffd\u07e962x\ufffdF\r\u0000\ufffd?\ufffdW>U\u001a\ufffd\u0016\u0011\ufffd\ufffd\ufffd9B\ufffd;J!U4\ufffdO\ufffd,zqb\ufffd\rf\u0007\ufffd;\ufffdG\ufffd\ufffd\ufffd\u000b\ufffdE\ufffdF\ufffd\ufffd<\ufffdp\u0448r\ufffd\u0000\u001a\ufffdN\ufffdY\ufffdy1\ufffd;PD\ufffd\ufffd\u0014'\u0019\ufffd2<<\u0019M\t\ufffd\u0007F\ufffdf\ufffd;\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0002\u0012\u0001\u0000\u0002\u000e\u0003\u0003b\ufffd\u061e\ufffd\ufffd?_K;\ufffd\ufffd\b\u0004\ufffd\ufffdd\ufffd\ufffd\nh\ufffdq\ufffd7\ufffd^L\ufffd\ufffdVA Y)\ufffdc\u0003\ufffd\ufffd\ufffd\\g\ufffd\ufffd:w7NV\ufffd\ufffd`\ufffdh\ufffd\u0015\ufffd\n$\u0018\ufffd=\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\r\u0000\ufffd", "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "database_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "591bc5678dff6c977fa0088fd56a5f79134923ef", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0012\u0001\u0000\u0002\u000e\u0003\u0003b\ufffd\u061e\ufffd\ufffd?_K;\ufffd\ufffd\b\u0004\ufffd\ufffdd\ufffd\ufffd\nh\ufffdq\ufffd7\ufffd^L\ufffd\ufffdVA Y)\ufffdc\u0003\ufffd\ufffd\ufffd\\g\ufffd\ufffd:w7NV\ufffd\ufffd`\ufffdh\ufffd\u0015\ufffd\n$\u0018\ufffd=\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\r\u0000\ufffd", "tls_ja3": "fd11ecad046fc95468d98e3409e4e8a5", "tls_sni": "blacklistip.com", "port": 3021, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "b\ufffd\u061e\ufffd\ufffd?_K;\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffd\nh\ufffdq\ufffd7\ufffd^L\ufffd\ufffdVA Y)\ufffdc\ufffd\ufffd\ufffd\\g\ufffd\ufffd:w7NV\ufffd\ufffd`\ufffdh\ufffd\ufffd\n$\ufffd= \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd\r\ufffd", "attack_vector": "mssql tds \u00b7 via TLS:3021 \u00b7 (sonde \/ probe)", "target_port_label": "3021 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 3021, "protocol_emulated": null, "tags_summary": [ "pat-0519" ], "tags_summary_labels_fr": [ "pat-0519" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0012\u0001\u0000\u0002\u000e\u0003\u0003b\ufffd\u061e\ufffd\ufffd?_K;\ufffd\ufffd\b\u0004\ufffd\ufffdd\ufffd\ufffd\nh\ufffdq\ufffd7\ufffd^L\ufffd\ufffdVA Y)\ufffdc\u0003\ufffd\ufffd\ufffd\\g\ufffd\ufffd:w7NV\ufffd\ufffd`\ufffdh\ufffd\u0015\ufffd\n$\u0018\ufffd=\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\r\u0000\ufffd", "tls_ja3": "fd11ecad046fc95468d98e3409e4e8a5", "tls_sni": "blacklistip.com", "port": 3021, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "mssql tds \u00b7 via TLS:3021 \u00b7 (sonde \/ probe)", "evidence_snippet": "b\ufffd\u061e\ufffd\ufffd?_K;\ufffd\ufffd\ufffd\ufffdd\ufffd\ufffd\nh\ufffdq\ufffd7\ufffd^L\ufffd\ufffdVA Y)\ufffdc\ufffd\ufffd\ufffd\\g\ufffd\ufffd:*w7NV\ufffd\ufffd`\ufffdh\ufffd\ufffd\n$\ufffd= \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd\r\ufffd", "target_port_label": "3021 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "3021" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }
06/08/2026 20:16:42 UTC	TCP	18099 · TLS	tls	Sonde TLS tls probe · via TLS:18099 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 b7433af103c40d63 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 18099 Chemin / cible — Service TLS Payload ��٫��Eӻ� ��h��9�Ed��(ڇ��tr' �k M��,fM��M�ܶ��J�9�^F�� +�/�,�0̨̩��/5�jjDih2 Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0607 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��٫��Eӻ� ��h��9�Ed��(ڇ��tr' �kM��,fM��M�ܶ��J�9�^F�� +�/�,�0̨̩��/5�jjDih2 Requête brute (extrait) ��٫��Eӻ� ��h��9�Ed��(ڇ��tr' �k M��,fM��M�ܶ��J�9�^F�� +�/�,�0̨̩��/5�jjDih2 # h2http/1.1�� 2 ��g�x�RQi�`�U<k�4!�-�F��Ae��?��f �irFB�v�L�$��ny�7]-��O Meta JSON brut { "tls_ja3_hash": "b7433af103c40d635172d1b1d7dfdc4e", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 511, "payload_entropy": 6.84196260828971, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 18099, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "10defb8b12b0508e3238504b64c9e997e17b12fe", "event_fingerprint": "465fa00232ff3d565baaab9b7bc1d3a1b9337ae2", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0607" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "b7433af103c40d635172d1b1d7dfdc4e", "payload_hash": "ddfd236b466d1e439dd34b2c99bb4984", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 18099, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u066b\ufffd\u0019\ufffdE\u04fb\ufffd \ufffd\ufffdh\ufffd\ufffd9\ufffdE\u0017d\ufffd\ufffd\ufffd\ufffd(\u0687\ufffd\ufffdtr' \ufffdk\fM\ufffd\ufffd\u0004,f\u0011M\ufffd\ufffd\u001b\ufffdM\ufffd\u0736\ufffd\u001c\ufffd\ufffdJ\ufffd9\ufffd^F\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdjj\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u066b\ufffd\u0019\ufffdE\u04fb\ufffd \ufffd\ufffdh\ufffd\ufffd9\ufffdE\u0017d\ufffd\ufffd\ufffd\ufffd(\u0687\ufffd\ufffdtr' \ufffdk\fM\ufffd\ufffd\u0004,f\u0011M\ufffd\ufffd\u001b\ufffdM\ufffd\u0736\ufffd\u001c\ufffd\ufffdJ\ufffd9\ufffd^F\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdjj\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\n\u0000\n\u0000\b\n\n\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\ufffd\u0001\u0000\u0001\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u00012\u0000 \ufffd\ufffd\ufffdg\ufffdx\ufffdRQi\ufffd`\ufffdU\u0017<k\ufffd4!\ufffd-\ufffdF\ufffd\ufffd\ufffdAe\ufffd\ufffd?\u0000\ufffd\ufffdf\u000b\ufffdirFB\ufffdv\ufffdL\ufffd$\ufffd\u0017\ufffd\ufffd\ufffdny\ufffd7]\u001c-\ufffd\ufffdO", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u066b\ufffd\u0019\ufffdE\u04fb\ufffd \ufffd\ufffdh\ufffd\ufffd9\ufffdE\u0017d\ufffd\ufffd\ufffd\ufffd(\u0687\ufffd\ufffdtr' \ufffdk\fM\ufffd\ufffd\u0004,f\u0011M\ufffd\ufffd\u001b\ufffdM\ufffd\u0736\ufffd\u001c\ufffd\ufffdJ\ufffd9\ufffd^F\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdjj\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7877e877302ac8b77648c2cc7c8a696aa93603af", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u066b\ufffd\u0019\ufffdE\u04fb\ufffd \ufffd\ufffdh\ufffd\ufffd9\ufffdE\u0017d\ufffd\ufffd\ufffd\ufffd(\u0687\ufffd\ufffdtr' \ufffdk\fM\ufffd\ufffd\u0004,f\u0011M\ufffd\ufffd\u001b\ufffdM\ufffd\u0736\ufffd\u001c\ufffd\ufffdJ\ufffd9\ufffd^F\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdjj\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000", "tls_ja3": "b7433af103c40d635172d1b1d7dfdc4e", "port": 18099, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\u066b\ufffd\ufffdE\u04fb\ufffd \ufffd\ufffdh\ufffd\ufffd9\ufffdEd\ufffd\ufffd\ufffd\ufffd(\u0687\ufffd\ufffdtr' \ufffdkM\ufffd\ufffd,fM\ufffd\ufffd\ufffdM\ufffd\u0736\ufffd\ufffd\ufffdJ\ufffd9\ufffd^F\ufffd\ufffd \n\n\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdjjDih2", "attack_vector": "tls probe \u00b7 via TLS:18099 \u00b7 (sonde \/ probe)", "target_port_label": "18099 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 18099, "protocol_emulated": null, "tags_summary": [ "pat-0607" ], "tags_summary_labels_fr": [ "pat-0607" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u066b\ufffd\u0019\ufffdE\u04fb\ufffd \ufffd\ufffdh\ufffd\ufffd9\ufffdE\u0017d\ufffd\ufffd\ufffd\ufffd(\u0687\ufffd\ufffdtr' \ufffdk\fM\ufffd\ufffd\u0004,f\u0011M\ufffd\ufffd\u001b\ufffdM\ufffd\u0736\ufffd\u001c\ufffd\ufffdJ\ufffd9\ufffd^F\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdjj\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000", "tls_ja3": "b7433af103c40d635172d1b1d7dfdc4e", "port": 18099, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:18099 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u066b\ufffd\ufffdE\u04fb\ufffd \ufffd\ufffdh\ufffd\ufffd9\ufffdEd\ufffd\ufffd\ufffd\ufffd(\u0687\ufffd\ufffdtr' \ufffdkM\ufffd\ufffd,fM\ufffd\ufffd\ufffdM\ufffd\u0736\ufffd\ufffd\ufffdJ\ufffd9\ufffd^F\ufffd\ufffd \n\n\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdjjDih2", "target_port_label": "18099 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "18099" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
06/08/2026 19:42:17 UTC	TCP	8280 · TLS	tls	Sonde TLS tls probe · via TLS:8280 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 1ff192da30722caa SNI www.blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI www.blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 8280 Chemin / cible — Service TLS SNI TLS www.blacklistip.com Payload �2��$h��<Sl��D��g��`0��8� ��^�.��{�C��1��cg��V�~R�߮ ��+�/�,�0̨̩��/5�� Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0607 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �2��$h��<Sl��D��g��`0��8� ��^�.��{�C��1��cg��V�~R�߮ ��+�/�,�0̨̩��/5�� Requête brute (extrait) �2��$h��<Sl��D��g��`0��8� ��^�.��{�C��1��cg��V�~R�߮ ��+�/�,�0̨̩��/5�� ::+ZZ� �� Џ��f ��%��- Rs�p#� �ie��y��LM�:�Nd�2��l��>l�j.� �jIo��:�?�O Meta JSON brut { "tls_ja3_hash": "1ff192da30722caa4ebc6ec755b9f134", "tls_sni": "www.blacklistip.com", "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 539, "payload_entropy": 6.850383137309912, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 8280, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c96fcfada4b7bbd6ee00131a84767628e72b3e5a", "event_fingerprint": "fa1d2963ba849e39d65c04729671432a83b6f994", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0607" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "1ff192da30722caa4ebc6ec755b9f134", "payload_hash": "d62f4edbbe8458f3865947b6f015bc59", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "www.blacklistip.com" }, "target_context": { "dst_port": 8280, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0016\u0001\u0000\u0002\u0012\u0003\u0003\ufffd2\ufffd\ufffd\ufffd\ufffd$h\ufffd\ufffd<Sl\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\u0002\ufffdg\ufffd\ufffd`0\ufffd\ufffd8\ufffd \ufffd\ufffd^\ufffd.\ufffd\ufffd\u001d{\ufffdC\ufffd\ufffd\ufffd1\ufffd\ufffdcg\u0002\u0004\ufffd\ufffdV\ufffd~R\ufffd\u07ee\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u000b\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0016\u0001\u0000\u0002\u0012\u0003\u0003\ufffd2\ufffd\ufffd\ufffd\ufffd$h\ufffd\ufffd<Sl\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\u0002\ufffdg\ufffd\ufffd`0\ufffd\ufffd8\ufffd \ufffd\ufffd^\ufffd.\ufffd\ufffd\u001d{\ufffdC\ufffd\ufffd\ufffd1\ufffd\ufffdcg\u0002\u0004\ufffd\ufffdV\ufffd~R\ufffd\u07ee\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b::\u0000\u001d\u0000\u0017\u0000\u0018\u0000+\u0000\u0007\u0006ZZ\u0003\u0004\u0003\u0003\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \ufffd\u040f\ufffd\ufffdf\u000b\ufffd\ufffd\ufffd\ufffd%\ufffd\ufffd-\fRs\ufffdp#\ufffd\u000b\u001c\ufffdie\ufffd\ufffdy\u0000\ufffd\ufffd\ufffd\u001d\ufffd\ufffd\ufffdLM\ufffd:\ufffdNd\ufffd\u00112\ufffd\ufffdl\ufffd\ufffd>l\ufffdj.\ufffd\u000e \ufffdjIo\ufffd\ufffd:\ufffd?\ufffdO", "payload_snippet": "\u0016\u0003\u0001\u0002\u0016\u0001\u0000\u0002\u0012\u0003\u0003\ufffd2\ufffd\ufffd\ufffd\ufffd$h\ufffd\ufffd<Sl\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\u0002\ufffdg\ufffd\ufffd`0\ufffd\ufffd8\ufffd \ufffd\ufffd^\ufffd.\ufffd\ufffd\u001d{\ufffdC\ufffd\ufffd\ufffd1\ufffd\ufffdcg\u0002\u0004\ufffd\ufffdV\ufffd~R\ufffd\u07ee\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u000b\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8f4cf91bcfa4ce4a359c16b1ba196240c8839d38", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0016\u0001\u0000\u0002\u0012\u0003\u0003\ufffd2\ufffd\ufffd\ufffd\ufffd$h\ufffd\ufffd<Sl\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\u0002\ufffdg\ufffd\ufffd`0\ufffd\ufffd8\ufffd \ufffd\ufffd^\ufffd.\ufffd\ufffd\u001d{\ufffdC\ufffd\ufffd\ufffd1\ufffd\ufffdcg\u0002\u0004\ufffd\ufffdV\ufffd~R\ufffd\u07ee\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u000b\u0000", "tls_ja3": "1ff192da30722caa4ebc6ec755b9f134", "tls_sni": "www.blacklistip.com", "port": 8280, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd2\ufffd\ufffd\ufffd\ufffd$h\ufffd\ufffd<Sl\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd`0\ufffd\ufffd8\ufffd \ufffd\ufffd^\ufffd.\ufffd\ufffd{\ufffdC\ufffd\ufffd\ufffd1\ufffd\ufffdcg\ufffd\ufffdV\ufffd~R\ufffd\u07ee \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd", "attack_vector": "tls probe \u00b7 via TLS:8280 \u00b7 (sonde \/ probe)", "target_port_label": "8280 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8280, "protocol_emulated": null, "tags_summary": [ "pat-0607" ], "tags_summary_labels_fr": [ "pat-0607" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0016\u0001\u0000\u0002\u0012\u0003\u0003\ufffd2\ufffd\ufffd\ufffd\ufffd$h\ufffd\ufffd<Sl\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\u0002\ufffdg\ufffd\ufffd`0\ufffd\ufffd8\ufffd \ufffd\ufffd^\ufffd.\ufffd\ufffd\u001d{\ufffdC\ufffd\ufffd\ufffd1\ufffd\ufffdcg\u0002\u0004\ufffd\ufffdV\ufffd~R\ufffd\u07ee\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u000b\u0000", "tls_ja3": "1ff192da30722caa4ebc6ec755b9f134", "tls_sni": "www.blacklistip.com", "port": 8280, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:8280 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd2\ufffd\ufffd\ufffd\ufffd$h\ufffd\ufffd<Sl\ufffd\ufffd\ufffdD\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd`0\ufffd\ufffd8\ufffd \ufffd\ufffd^\ufffd.\ufffd\ufffd{\ufffdC\ufffd\ufffd\ufffd1\ufffd\ufffdcg\ufffd\ufffdV\ufffd~R\ufffd\u07ee \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd", "target_port_label": "8280 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8280" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "port:8280", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }
06/08/2026 19:41:54 UTC	TCP	8280	—	Sonde Kafka kafka probe · port 8280 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8280 Chemin / cible — Payload ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Requête brute (extrait) ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� # h2http/1.1 3&$ sH?�ߑ��`��%�ϋ5��߅�wM��-+ Meta JSON brut { "bytes_in": 501, "payload_entropy": 3.7940870380940184, "port_category": "registered", "org": "Zenlayer Inc", "service": null, "app_proto": null, "asn": 62610, "country": "US", "dst_port": 8280, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 0.5, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "6ef1c8cf7f6be76132fed1c47ae0f8d721bb6b75", "event_fingerprint": "e13fc53d559b092b0b94b4a63ad2088f23cdc385", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "29b5329f45e73a6677bca0caf0ca278c", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 8280, "risk_score": 32 }, "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003", "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5ca5cfa2e90268827b46af1db6c65e6ebe819b5d", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 8280 }, "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 port 8280 \u00b7 (sonde \/ probe)", "target_port_label": "8280", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 8280, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 8280 }, "attack_vector": "kafka probe \u00b7 port 8280 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "target_port_label": "8280", "emulator_service": null, "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "8280" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
06/08/2026 19:13:44 UTC	TCP	8170	—	Sonde Kafka kafka probe · port 8170 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8170 Chemin / cible — Payload �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Requête brute (extrait) �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� # h2http/1.1 3&$ sH?�ߑ��`��%�ϋ5��߅�wM��-+ Meta JSON brut { "bytes_in": 520, "payload_entropy": 3.999375592941219, "port_category": "registered", "org": "Zenlayer Inc", "service": null, "app_proto": null, "asn": 62610, "country": "US", "dst_port": 8170, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "6f4b6f5bce4c9e4de3b061f46ba090fae6d84f4b", "event_fingerprint": "7db954fb6b7c1071c726dcfa2877c19aefcc4f33", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3406a76f136d489bc5c37b989c06ec84", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 8170, "risk_score": 32 }, "payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003", "payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "db2084fac8de7ec3804186e53d13d03f42f09d4f", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 8170 }, "evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 port 8170 \u00b7 (sonde \/ probe)", "target_port_label": "8170", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 8170, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 8170 }, "attack_vector": "kafka probe \u00b7 port 8170 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "target_port_label": "8170", "emulator_service": null, "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "8170" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
06/08/2026 19:06:39 UTC	TCP	4999 · TLS	tls	Sonde TLS tls probe · via TLS:4999 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 d8ab50ee27cb3960 SNI blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 4999 Chemin / cible — Service TLS SNI TLS blacklistip.com Payload RNvg��}�~��h_��S��ey��^h]!/ t�� i[ ��u��T(�`�}mW ��_� ��+�/�,�0̨̩��/5��-� Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) RNvg��}�~��h_��S��ey��^h]!/ t��i[ ��u��T(�`�}mW��_� ��+�/�,�0̨̩��/5��-� Requête brute (extrait) RNvg��}�~��h_��S��ey��^h]!/ t�� i[ ��u��T(�`�}mW ��_� ��+�/�,�0̨̩��/5��-�+�� #3+)�� 9uA��w��S��"/TN�=���4 "� � ��gҌ ˄i�g �g��YH�� Meta JSON brut { "tls_ja3_hash": "d8ab50ee27cb3960c5d7971314c8b358", "tls_sni": "blacklistip.com", "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 599, "payload_entropy": 6.950046900899181, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 4999, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "b4ba895aecfb1733e4e455c76bd2d1a81cbf7a9e", "event_fingerprint": "8a92ea662be34c2e8c37c71bd947c2ce675d70a0", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "d8ab50ee27cb3960c5d7971314c8b358", "payload_hash": "8c2fa287e231534adfe0f5be670dbef0", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "blacklistip.com" }, "target_context": { "dst_port": 4999, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002R\u0001\u0000\u0002N\u0003\u0003v\u0007g\ufffd\ufffd\ufffd}\ufffd~\ufffd\ufffdh_\ufffd\ufffdS\ufffd\ufffd\ufffdey\ufffd\ufffd\ufffd^\u000fh]!\u000f\/ t\ufffd\ufffd\f\ufffd\ufffdi[ \ufffd\ufffd\ufffdu\ufffd\u0019\ufffdT(\u0010\ufffd`\ufffd}mW\f\u001a\ufffd\ufffd_\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\ufffd\u0001\u0000\u0001", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002R\u0001\u0000\u0002N\u0003\u0003v\u0007g\ufffd\ufffd\ufffd}\ufffd~\ufffd\ufffdh_\ufffd\ufffdS\ufffd\ufffd\ufffdey\ufffd\ufffd\ufffd^\u000fh]!\u000f\/ t\ufffd\ufffd\f\ufffd\ufffdi[ \ufffd\ufffd\ufffdu\ufffd\u0019\ufffdT(\u0010\ufffd`\ufffd}mW\f\u001a\ufffd\ufffd_\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\ufffd\u0001\u0000\u0001\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003\u0003\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 9uA\ufffd\ufffdw\ufffd\ufffd\u0017\ufffdS\u0012\ufffd\u0011\u0007\ufffd\"\/T\u0014N\ufffd=\ufffd\u001e\ufffd\u0019\ufffd4\r\"\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \ufffd\ufffd\ufffd\ufffd\u0016g\u048c \u02c4i\ufffdg\t\ufffdg\ufffd\ufffd\ufffdYH\ufffd\u0013\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0002R\u0001\u0000\u0002N\u0003\u0003v\u0007g\ufffd\ufffd\ufffd}\ufffd~\ufffd\ufffdh_\ufffd\ufffdS\ufffd\ufffd\ufffdey\ufffd\ufffd\ufffd^\u000fh]!\u000f\/ t\ufffd\ufffd\f\ufffd\ufffdi[ \ufffd\ufffd\ufffdu\ufffd\u0019\ufffdT(\u0010\ufffd`\ufffd}mW\f\u001a\ufffd\ufffd_\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\ufffd\u0001\u0000\u0001", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e9af83125a31a1149ceb9891a9d96cacc40b0c91", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002R\u0001\u0000\u0002N\u0003\u0003v\u0007g\ufffd\ufffd\ufffd}\ufffd~\ufffd\ufffdh_\ufffd\ufffdS\ufffd\ufffd\ufffdey\ufffd\ufffd\ufffd^\u000fh]!\u000f\/ t\ufffd\ufffd\f\ufffd\ufffdi[ \ufffd\ufffd\ufffdu\ufffd\u0019\ufffdT(\u0010\ufffd`\ufffd}mW\f\u001a\ufffd\ufffd_\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\ufffd\u0001\u0000\u0001", "tls_ja3": "d8ab50ee27cb3960c5d7971314c8b358", "tls_sni": "blacklistip.com", "port": 4999, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "RNvg\ufffd\ufffd\ufffd}\ufffd~\ufffd\ufffdh_\ufffd\ufffdS\ufffd\ufffd\ufffdey\ufffd\ufffd\ufffd^h]!\/ t\ufffd\ufffd\ufffd\ufffdi[ \ufffd\ufffd\ufffdu\ufffd\ufffdT(\ufffd`\ufffd}mW\ufffd\ufffd_\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd-\ufffd", "attack_vector": "tls probe \u00b7 via TLS:4999 \u00b7 (sonde \/ probe)", "target_port_label": "4999 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 4999, "protocol_emulated": null, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002R\u0001\u0000\u0002N\u0003\u0003v\u0007g\ufffd\ufffd\ufffd}\ufffd~\ufffd\ufffdh_\ufffd\ufffdS\ufffd\ufffd\ufffdey\ufffd\ufffd\ufffd^\u000fh]!\u000f\/ t\ufffd\ufffd\f\ufffd\ufffdi[ \ufffd\ufffd\ufffdu\ufffd\u0019\ufffdT(\u0010\ufffd`\ufffd}mW\f\u001a\ufffd\ufffd_\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\ufffd\u0001\u0000\u0001", "tls_ja3": "d8ab50ee27cb3960c5d7971314c8b358", "tls_sni": "blacklistip.com", "port": 4999, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:4999 \u00b7 (sonde \/ probe)", "evidence_snippet": "RNvg\ufffd\ufffd\ufffd}\ufffd~\ufffd\ufffdh_\ufffd\ufffdS\ufffd\ufffd\ufffdey\ufffd\ufffd\ufffd^h]!\/ t\ufffd\ufffd\ufffd\ufffdi[ \ufffd\ufffd\ufffdu\ufffd\ufffdT(\ufffd`\ufffd}mW\ufffd*\ufffd_\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd-\ufffd", "target_port_label": "4999 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "4999" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }
06/08/2026 19:04:29 UTC	TCP	8145 · TLS	tls	Sonde TLS tls probe · via TLS:8145 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 6b5c64bbbaeba84c Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8145 Chemin / cible — Service TLS Payload ��mM��߱p "�o{�NO�Q{��!�� 3��\|Q��өM(��ě�� +�/�,�0̨̩��/5m:: Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0607 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��mM��߱p "�o{�NO�Q{��!�� 3��\|Q��өM(��ě�� +�/�,�0̨̩��/5m:: Requête brute (extrait) ��mM��߱p "�o{�NO�Q{��!�� 3��\|Q��өM(��ě�� +�/�,�0̨̩��/5m:: � h2http/1.1+��Dih2#� � ��]��x�{�_�D��4��M��(5��E`�� Meta JSON brut { "tls_ja3_hash": "6b5c64bbbaeba84cf20992a01614dd01", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 479, "payload_entropy": 6.806789615287889, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 8145, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "b1875a26854b32219726fe3f75d58c337c902705", "event_fingerprint": "d4753596ae651cf078efab9c9484ff6d91bf5863", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0607" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "6b5c64bbbaeba84cf20992a01614dd01", "payload_hash": "8c0c58cb5adf2eaa8d0578f5235702e5", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 8145, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003mM\ufffd\ufffd\u07f1\u0019p\r\"\u0012\ufffd\u001d\u001c\u001ao\u0005{\ufffdNO\ufffdQ{\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd \u0012\ufffd\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffd\u0001\|Q\ufffd\ufffd\ufffd\ufffd\ufffd\u04e9\u0000M(\ufffd\ufffd\u011b\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m::\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003mM\ufffd\ufffd\u07f1\u0019p\r\"\u0012\ufffd\u001d\u001c\u001ao\u0005{\ufffdNO\ufffdQ{\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd \u0012\ufffd\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffd\u0001\|Q\ufffd\ufffd\ufffd\ufffd\ufffd\u04e9\u0000M(\ufffd\ufffd\u011b\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m::\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003\u0003Di\u0000\u0005\u0000\u0003\u0002h2\u0000\u0012\u0000\u0000\u0000#\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\u000e\u0000 \ufffd\ufffd\u001b]\ufffd\ufffdx\ufffd{\ufffd_\ufffdD\ufffd\ufffd\ufffd4\ufffd\ufffdM\ufffd\ufffd\u0005\u001b(5\ufffd\u0013\ufffdE`\u0000\ufffd\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003mM\ufffd\ufffd\u07f1\u0019p\r\"\u0012\ufffd\u001d\u001c\u001ao\u0005{\ufffdNO\ufffdQ{\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd \u0012\ufffd\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffd\u0001\|Q\ufffd\ufffd\ufffd\ufffd\ufffd\u04e9\u0000M(\ufffd\ufffd\u011b\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m::\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3398f994f3dbaae0217268a5bdcb330ae524f685", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003mM\ufffd\ufffd\u07f1\u0019p\r\"\u0012\ufffd\u001d\u001c\u001ao\u0005{\ufffdNO\ufffdQ{\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd \u0012\ufffd\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffd\u0001\|Q\ufffd\ufffd\ufffd\ufffd\ufffd\u04e9\u0000M(\ufffd\ufffd\u011b\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m::\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000", "tls_ja3": "6b5c64bbbaeba84cf20992a01614dd01", "port": 8145, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdmM\ufffd\ufffd\u07f1p\r\"\ufffdo{\ufffdNO\ufffdQ{\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd \ufffd\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffd\|Q\ufffd\ufffd\ufffd\ufffd\ufffd\u04e9M(\ufffd\ufffd\u011b\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5m::", "attack_vector": "tls probe \u00b7 via TLS:8145 \u00b7 (sonde \/ probe)", "target_port_label": "8145 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8145, "protocol_emulated": null, "tags_summary": [ "pat-0607" ], "tags_summary_labels_fr": [ "pat-0607" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003mM\ufffd\ufffd\u07f1\u0019p\r\"\u0012\ufffd\u001d\u001c\u001ao\u0005{\ufffdNO\ufffdQ{\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd \u0012\ufffd\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffd\u0001\|Q\ufffd\ufffd\ufffd\ufffd\ufffd\u04e9\u0000M(\ufffd\ufffd\u011b\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m::\u0000\u0000\u0000\u0017\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000", "tls_ja3": "6b5c64bbbaeba84cf20992a01614dd01", "port": 8145, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:8145 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdmM\ufffd\ufffd\u07f1p\r\"\ufffdo{\ufffdNO\ufffdQ{\ufffd\ufffd\ufffd\ufffd\ufffd!\ufffd\ufffd \ufffd\ufffd3\ufffd\ufffd\ufffd\ufffd\ufffd\|Q\ufffd\ufffd\ufffd\ufffd\ufffd\u04e9M(\ufffd\ufffd\u011b\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5m::", "target_port_label": "8145 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8145" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
06/08/2026 19:04:14 UTC	TCP	8145 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:8145 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 20b279993ae2e137 SNI ip-62-3-50-33.v4.isp.servpersosystems.net Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 Cible HTTP — TLS SNI ip-62-3-50-33.v4.isp.servpersosystems.net Capteur paris-1
Preuve / Evidence Méthode — Port 8145 Chemin / cible — Service TLS SNI TLS ip-62-3-50-33.v4.isp.servpersosystems.net Payload ��~�]�JJ��N.Q��7&/�j��Gs�N�� /�$�5Ű�w(��&��댺��7Ϻ�+�/�,�0̨̩� �� .,)ip-62-3-50- Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��~�]�JJ��N.Q��7&/�j��Gs�N�� /�$�5Ű�w(��&��댺��7Ϻ�+�/�,�0̨̩� �� .,)ip-62-3-50- Requête brute (extrait) ��~�]�JJ��N.Q��7&/�j��Gs�N�� /�$�5Ű�w(��&��댺��7Ϻ�+�/�,�0̨̩� �� .,)ip-62-3-50-33.v4.isp.servpersosystems.net � � 2 Meta JSON brut { "tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "bytes_in": 1533, "payload_entropy": 7.699687583080591, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 8145, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "a4683d84069271da94dc7d9ecb0fdd89d5d23b46", "event_fingerprint": "40614b5391c0177810e6e5c098781f6f2b33c924", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "20b279993ae2e137e62b9647c6d768fb", "payload_hash": "ec66461c72dbe3f6739d39c043b6096e", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net" }, "target_context": { "dst_port": 8145, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003~\u0002\b\ufffd]\ufffdJ\u0005J\ufffd\ufffdN.\u0019Q\ufffd\ufffd7&\/\ufffdj\ufffd\ufffdGs\ufffdN\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\/\ufffd\u0012$\ufffd5\u0170\ufffdw(\ufffd\ufffd&\ufffd\ufffd\ub33a\u0019\ufffd\u001b\u0000\ufffd\ufffd\ufffd7\u03fa\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003~\u0002\b\ufffd]\ufffdJ\u0005J\ufffd\ufffdN.\u0019Q\ufffd\ufffd7&\/\ufffdj\ufffd\ufffdGs\ufffdN\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\/\ufffd\u0012$\ufffd5\u0170\ufffdw(\ufffd\ufffd&\ufffd\ufffd\ub33a\u0019\ufffd\u001b\u0000\ufffd\ufffd\ufffd7\u03fa\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-33.v4.isp.servpersosystems.net\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003~\u0002\b\ufffd]\ufffdJ\u0005J\ufffd\ufffdN.\u0019Q\ufffd\ufffd7&\/\ufffdj\ufffd\ufffdGs\ufffdN\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\/\ufffd\u0012$\ufffd5\u0170\ufffdw(\ufffd\ufffd&\ufffd\ufffd\ub33a\u0019\ufffd\u001b\u0000\ufffd\ufffd\ufffd7\u03fa\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "28a554f1d2a4d7a71242e4e0efb85572ed43f4e8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003~\u0002\b\ufffd]\ufffdJ\u0005J\ufffd\ufffdN.\u0019Q\ufffd\ufffd7&\/\ufffdj\ufffd\ufffdGs\ufffdN\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\/\ufffd\u0012$\ufffd5\u0170\ufffdw(\ufffd\ufffd&\ufffd\ufffd\ub33a\u0019\ufffd\u001b\u0000\ufffd\ufffd\ufffd7\u03fa\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 8145, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd~\ufffd]\ufffdJJ\ufffd\ufffdN.Q\ufffd\ufffd7&\/\ufffdj\ufffd\ufffdGs\ufffdN\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\/\ufffd$\ufffd5\u0170\ufffdw(\ufffd\ufffd&\ufffd\ufffd\ub33a\ufffd\ufffd\ufffd\ufffd7\u03fa\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd.,)ip-62-3-50-", "attack_vector": "postgres probe \u00b7 via TLS:8145 \u00b7 (sonde \/ probe)", "target_port_label": "8145 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8145, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003~\u0002\b\ufffd]\ufffdJ\u0005J\ufffd\ufffdN.\u0019Q\ufffd\ufffd7&\/\ufffdj\ufffd\ufffdGs\ufffdN\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\/\ufffd\u0012$\ufffd5\u0170\ufffdw(\ufffd\ufffd&\ufffd\ufffd\ub33a\u0019\ufffd\u001b\u0000\ufffd\ufffd\ufffd7\u03fa\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 8145, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:8145 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd~\ufffd]\ufffdJJ\ufffd\ufffdN.Q\ufffd\ufffd7&\/\ufffdj\ufffd\ufffdGs\ufffdN\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\/\ufffd$\ufffd5\u0170\ufffdw(\ufffd\ufffd&\ufffd\ufffd\ub33a\ufffd\ufffd\ufffd\ufffd7\u03fa\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd.,)ip-62-3-50-", "target_port_label": "8145 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8145" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3" ] }
06/08/2026 18:26:15 UTC	TCP	8238 · TLS	tls	Sonde TLS tls probe · via TLS:8238 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 956b3baa75b7e3cc SNI blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 8238 Chemin / cible — Service TLS SNI TLS blacklistip.com Payload RN@�:�s+�2��x(��1E쯛�O��~�� 2�tC �R��d/��L��{d��n-� ::�+�/�,�0̨̩��/5庺� ^ Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) RN@�:�s+�2��x(��1E쯛�O��~�� 2�tC�R��d/��L��{d��n-� ::�+�/�,�0̨̩��/5庺� ^ Requête brute (extrait) RN@�:�s+�2��x(��1E쯛�O��~�� 2�tC �R��d/��L��{d��n-� ::�+�/�,�0̨̩��/5庺� ^ UF�?�B(��ŋ�^_t�VgP9�R�k%R�S�`RZ� �i��N�җ��4�g�!D)�ޯ�t'0D<m� ?�K\�Z�v��@��g��'�R3/%)ZK7� ر+m��E�5!�� Meta JSON brut { "tls_ja3_hash": "956b3baa75b7e3ccfb9e0357d65bf92e", "tls_sni": "blacklistip.com", "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 599, "payload_entropy": 6.99270521715108, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 8238, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "1a8eebc5921a5bc08207af617b581f060de7046f", "event_fingerprint": "7cfd8a57fd79242b44fe96905336aaefab4211c6", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "956b3baa75b7e3ccfb9e0357d65bf92e", "payload_hash": "7702e1ca0539a2f80360f8b5919ccbd7", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "blacklistip.com" }, "target_context": { "dst_port": 8238, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002R\u0001\u0000\u0002N\u0003\u0003@\u000f\ufffd:\ufffds+\ufffd2\ufffd\u0018\ufffd\u001cx(\ufffd\ufffd1E\ucbdb\ufffdO\u0002\u0005\ufffd\ufffd~\ufffd\ufffd\ufffd \ufffd\ufffd2\ufffd\u001ftC\u000b\ufffd\u001dR\ufffd\b\ufffd\ufffdd\/\ufffd\ufffd\u001eL\ufffd\ufffd\ufffd{d\ufffd\ufffd\u0019n-\ufffd\u0000 ::\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u5eba\u0000\u0000\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001^", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002R\u0001\u0000\u0002N\u0003\u0003@\u000f\ufffd:\ufffds+\ufffd2\ufffd\u0018\ufffd\u001cx(\ufffd\ufffd1E\ucbdb\ufffdO\u0002\u0005\ufffd\ufffd~\ufffd\ufffd\ufffd \ufffd\ufffd2\ufffd\u001ftC\u000b\ufffd\u001dR\ufffd\b\ufffd\ufffdd\/\ufffd\ufffd\u001eL\ufffd\ufffd\ufffd{d\ufffd\ufffd\u0019n-\ufffd\u0000 ::\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u5eba\u0000\u0000\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001^\u0000 UF\ufffd?\ufffd\u0014B(\ufffd\ufffd\u014b\ufffd^_t\u0014\ufffd\u001eVgP\u00189\ufffdR\ufffdk%R\ufffdS\u0000\ufffd`R\u000eZ\ufffd \ufffdi\ufffd\ufffd\ufffd\ufffdN\ufffd\u0497\ufffd\ufffd4\ufffdg\ufffd\u0006!D)\ufffd\u07af\ufffd\u001bt'0D<m\ufffd\n?\ufffdK\\\ufffdZ\u0018\u0003\ufffd\u001fv\ufffd\ufffd\ufffd@\ufffd\ufffd\u0001\ufffdg\ufffd\ufffd'\ufffdR3\/%)Z\u0005K7\ufffd\f\u0631+m\ufffd\ufffdE\ufffd5!\ufffd\ufffd\ufffd\ufffd\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0002R\u0001\u0000\u0002N\u0003\u0003@\u000f\ufffd:\ufffds+\ufffd2\ufffd\u0018\ufffd\u001cx(\ufffd\ufffd1E\ucbdb\ufffdO\u0002\u0005\ufffd\ufffd~\ufffd\ufffd\ufffd \ufffd\ufffd2\ufffd\u001ftC\u000b\ufffd\u001dR\ufffd\b\ufffd\ufffdd\/\ufffd\ufffd\u001eL\ufffd\ufffd\ufffd{d\ufffd\ufffd\u0019n-\ufffd\u0000 ::\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u5eba\u0000\u0000\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001^", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fa0cb00e7cb8f3d43bf32d08c52cf83620740acb", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002R\u0001\u0000\u0002N\u0003\u0003@\u000f\ufffd:\ufffds+\ufffd2\ufffd\u0018\ufffd\u001cx(\ufffd\ufffd1E\ucbdb\ufffdO\u0002\u0005\ufffd\ufffd~\ufffd\ufffd\ufffd \ufffd\ufffd2\ufffd\u001ftC\u000b\ufffd\u001dR\ufffd\b\ufffd\ufffdd\/\ufffd\ufffd\u001eL\ufffd\ufffd\ufffd{d\ufffd\ufffd\u0019n-\ufffd\u0000 ::\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u5eba\u0000\u0000\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001^", "tls_ja3": "956b3baa75b7e3ccfb9e0357d65bf92e", "tls_sni": "blacklistip.com", "port": 8238, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "RN@\ufffd:\ufffds+\ufffd2\ufffd\ufffdx(\ufffd\ufffd1E\ucbdb\ufffdO\ufffd\ufffd~\ufffd\ufffd\ufffd \ufffd\ufffd2\ufffdtC\ufffdR\ufffd\ufffd\ufffdd\/\ufffd\ufffdL\ufffd\ufffd\ufffd{d\ufffd\ufffdn-\ufffd ::\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\u5eba\ufffd\r^", "attack_vector": "tls probe \u00b7 via TLS:8238 \u00b7 (sonde \/ probe)", "target_port_label": "8238 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8238, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002R\u0001\u0000\u0002N\u0003\u0003@\u000f\ufffd:\ufffds+\ufffd2\ufffd\u0018\ufffd\u001cx(\ufffd\ufffd1E\ucbdb\ufffdO\u0002\u0005\ufffd\ufffd~\ufffd\ufffd\ufffd \ufffd\ufffd2\ufffd\u001ftC\u000b\ufffd\u001dR\ufffd\b\ufffd\ufffdd\/\ufffd\ufffd\u001eL\ufffd\ufffd\ufffd{d\ufffd\ufffd\u0019n-\ufffd\u0000 ::\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u5eba\u0000\u0000\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001^", "tls_ja3": "956b3baa75b7e3ccfb9e0357d65bf92e", "tls_sni": "blacklistip.com", "port": 8238, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:8238 \u00b7 (sonde \/ probe)", "evidence_snippet": "RN@\ufffd:\ufffds+\ufffd2\ufffd\ufffdx(\ufffd\ufffd1E\ucbdb\ufffdO\ufffd\ufffd~\ufffd\ufffd\ufffd \ufffd\ufffd2\ufffdtC\ufffdR\ufffd\ufffd\ufffdd\/\ufffd\ufffdL\ufffd\ufffd\ufffd{d\ufffd\ufffdn-\ufffd ::\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\u5eba\ufffd\r^", "target_port_label": "8238 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8238" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }
06/08/2026 16:28:19 UTC	TCP	12198	—	Sonde Kafka kafka probe · port 12198 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 12198 Chemin / cible — Payload �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Requête brute (extrait) �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� # h2http/1.1 3&$ sH?�ߑ��`��%�ϋ5��߅�wM��-+ Meta JSON brut { "bytes_in": 520, "payload_entropy": 3.999375592941219, "port_category": "registered", "org": "Zenlayer Inc", "service": null, "app_proto": null, "asn": 62610, "country": "US", "dst_port": 12198, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.4, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "aef4e858509f2b7ee50ef7a531dfe5ada5a7d029", "event_fingerprint": "06debb40e36dd4bb39307c08f5a4ca2b13c78831", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3406a76f136d489bc5c37b989c06ec84", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 12198, "risk_score": 32 }, "payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003", "payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "7670cbe46b0a9eb5c6aa359be044f0f7994b4deb", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 12198 }, "evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 port 12198 \u00b7 (sonde \/ probe)", "target_port_label": "12198", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 12198, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 12198 }, "attack_vector": "kafka probe \u00b7 port 12198 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "target_port_label": "12198", "emulator_service": null, "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "12198" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
06/08/2026 16:28:18 UTC	TCP	12198	—	Sonde Kafka kafka probe · port 12198 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 12198 Chemin / cible — Payload ߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Requête brute (extrait) ߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� # h2http/1.1 3&$ sH?�ߑ��`��%�ϋ5��߅�wM��-+ Meta JSON brut { "bytes_in": 542, "payload_entropy": 4.161650730260368, "port_category": "registered", "org": "Zenlayer Inc", "service": null, "app_proto": null, "asn": 62610, "country": "US", "dst_port": 12198, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.4, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "aef4e858509f2b7ee50ef7a531dfe5ada5a7d029", "event_fingerprint": "06debb40e36dd4bb39307c08f5a4ca2b13c78831", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4509eec7340acca41e94bc6bae32c197", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 12198, "risk_score": 32 }, "payload_snippet": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003", "payload_snippet": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "176f170d596e2e1de69dc480b61311aa358b8dc8", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 12198 }, "evidence_snippet": "\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 port 12198 \u00b7 (sonde \/ probe)", "target_port_label": "12198", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 12198, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 12198 }, "attack_vector": "kafka probe \u00b7 port 12198 \u00b7 (sonde \/ probe)", "evidence_snippet": "\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "target_port_label": "12198", "emulator_service": null, "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "12198" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
06/08/2026 15:44:48 UTC	TCP	943	—	Sonde Kafka kafka probe · port 943 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 943 Chemin / cible — Payload �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Requête brute (extrait) �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� # h2http/1.1 3&$ sH?�ߑ��`��%�ϋ5��߅�wM��-+ Meta JSON brut { "bytes_in": 520, "payload_entropy": 3.999375592941219, "port_category": "well_known", "org": "Zenlayer Inc", "service": null, "app_proto": null, "asn": 62610, "country": "US", "dst_port": 943, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "0453cdcee1c6d1c192a5240e416a74eaa62029d4", "event_fingerprint": "1676cad7f67d069871152a1ad84ef6ffe4a11e15", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3406a76f136d489bc5c37b989c06ec84", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 943, "risk_score": 32 }, "payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003", "payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "af1b50d6fe5eddfdccbe79754220ad3c2358cd93", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 943 }, "evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 port 943 \u00b7 (sonde \/ probe)", "target_port_label": "943", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 943, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 943 }, "attack_vector": "kafka probe \u00b7 port 943 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "target_port_label": "943", "emulator_service": null, "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "943" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
06/08/2026 15:29:18 UTC	TCP	8143 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:8143 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 20b279993ae2e137 SNI ip-62-3-50-33.v4.isp.servpersosystems.net Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 Cible HTTP — TLS SNI ip-62-3-50-33.v4.isp.servpersosystems.net Capteur paris-1
Preuve / Evidence Méthode — Port 8143 Chemin / cible — Service TLS SNI TLS ip-62-3-50-33.v4.isp.servpersosystems.net Payload ��4��U�bC��=�� 5;��_��֌7Z /��X��&�2�o?�_�T�ʕ�J��R.��+�/�,�0̨̩� �� .,)ip-62-3-50- Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��4��U�bC��=�� 5;��_��֌7Z /��X��&�2�o?�_�T�ʕ�J��R.��+�/�,�0̨̩� �� .,)ip-62-3-50- Requête brute (extrait) ��4��U�bC��=�� 5;��_��֌7Z /��X��&�2�o?�_�T�ʕ�J��R.��+�/�,�0̨̩� �� .,)ip-62-3-50-33.v4.isp.servpersosystems.net � � 2 Meta JSON brut { "tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "bytes_in": 1533, "payload_entropy": 7.731719267142996, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 8143, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "079897024c604039fadcbc9c00b6236ce841426c", "event_fingerprint": "b58a9231fb9a8cc6cd05daa83c32a0a385f4aa65", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "20b279993ae2e137e62b9647c6d768fb", "payload_hash": "dd9d430d265bf583aa67e14cdc4dd6a5", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net" }, "target_context": { "dst_port": 8143, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00034\ufffd\ufffdU\ufffdbC\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\t\ufffd\ufffd5;\ufffd\ufffd\ufffd_\ufffd\u001a\ufffd\ufffd\u058c7Z \u001f\/\ufffd\ufffdX\u0012\ufffd\ufffd&\ufffd2\ufffdo?\u001f\ufffd_\u0001\ufffdT\ufffd\u0295\ufffdJ\ufffd\ufffdR.\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00034\ufffd\ufffdU\ufffdbC\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\t\ufffd\ufffd5;\ufffd\ufffd\ufffd_\ufffd\u001a\ufffd\ufffd\u058c7Z \u001f\/\ufffd\ufffdX\u0012\ufffd\ufffd&\ufffd2\ufffdo?\u001f\ufffd_\u0001\ufffdT\ufffd\u0295\ufffdJ\ufffd\ufffdR.\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-33.v4.isp.servpersosystems.net\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00034\ufffd\ufffdU\ufffdbC\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\t\ufffd\ufffd5;\ufffd\ufffd\ufffd_\ufffd\u001a\ufffd\ufffd\u058c7Z \u001f\/\ufffd\ufffdX\u0012\ufffd\ufffd&\ufffd2\ufffdo?\u001f\ufffd_\u0001\ufffdT\ufffd\u0295\ufffdJ\ufffd\ufffdR.\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "def5027b7eb80cf3cc45ac3af850b85dac11222b", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00034\ufffd\ufffdU\ufffdbC\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\t\ufffd\ufffd5;\ufffd\ufffd\ufffd_\ufffd\u001a\ufffd\ufffd\u058c7Z \u001f\/\ufffd\ufffdX\u0012\ufffd\ufffd&\ufffd2\ufffdo?\u001f\ufffd_\u0001\ufffdT\ufffd\u0295\ufffdJ\ufffd\ufffdR.\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 8143, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd4\ufffd\ufffdU\ufffdbC\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\t\ufffd\ufffd5;\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd\u058c7Z \/\ufffd\ufffdX\ufffd\ufffd&\ufffd2\ufffdo?\ufffd_\ufffdT\ufffd\u0295\ufffdJ\ufffd\ufffdR.\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd.,)ip-62-3-50-", "attack_vector": "postgres probe \u00b7 via TLS:8143 \u00b7 (sonde \/ probe)", "target_port_label": "8143 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8143, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u00034\ufffd\ufffdU\ufffdbC\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\t\ufffd\ufffd5;\ufffd\ufffd\ufffd_\ufffd\u001a\ufffd\ufffd\u058c7Z \u001f\/\ufffd\ufffdX\u0012\ufffd\ufffd&\ufffd2\ufffdo?\u001f\ufffd_\u0001\ufffdT\ufffd\u0295\ufffdJ\ufffd\ufffdR.\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 8143, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:8143 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd4\ufffd\ufffdU\ufffdbC\ufffd\ufffd\ufffd\ufffd=\ufffd\ufffd\ufffd\t\ufffd\ufffd5;\ufffd\ufffd\ufffd_\ufffd\ufffd\ufffd\u058c7Z \/\ufffd\ufffdX\ufffd\ufffd&\ufffd2\ufffdo?\ufffd_\ufffdT\ufffd\u0295\ufffdJ\ufffd\ufffdR.\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd.,)ip-62-3-50-", "target_port_label": "8143 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8143" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3" ] }
06/08/2026 14:52:00 UTC	TCP	3071 · TLS	tls	Sonde TLS tls probe · via TLS:3071 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 3642a49605ec090c SNI ip-62-3-50-33.v4.isp.servpersosystems.net Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI ip-62-3-50-33.v4.isp.servpersosystems.net Capteur paris-1
Preuve / Evidence Méthode — Port 3071 Chemin / cible — Service TLS SNI TLS ip-62-3-50-33.v4.isp.servpersosystems.net Payload � �U� $�L3�hc7 Ŧ��͒z�_T8� �/��+ԃC�\|�n9��q��)N1 񋏣 ��+�/�,�0̨̩��/5�� f Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) � �U�$�L3�hc7 Ŧ��͒z�_T8� �/��+ԃC�\|�n9��q��)N1 񋏣 ��+�/�,�0̨̩��/5�� f Requête brute (extrait) � �U� $�L3�hc7 Ŧ��͒z�_T8� �/��+ԃC�\|�n9��q��)N1 񋏣 ��+�/�,�0̨̩��/5�� f uD��H�p��ڷl�N�7�/��q��B�Z��)�7Hr�낅Mc��r��\|z"�'�;��Q� K�RQQ��ס_")�a��9� ��Qў�/!��Z�-�S#�4�� Meta JSON brut { "tls_ja3_hash": "3642a49605ec090cad5d943bbe79400d", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 529, "payload_entropy": 6.804088443174939, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 3071, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "ab1c13e93cf7758e522da7b6e5a37295a67dd3f4", "event_fingerprint": "57bea3f328a5ec0a0b9f192506ddc6b84c313b33", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "3642a49605ec090cad5d943bbe79400d", "payload_hash": "7e0af877156e0c910d0ed76d56fca118", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net" }, "target_context": { "dst_port": 3071, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\ufffd \ufffdU\u001c\u0007\ufffd\u000b$\ufffdL3\ufffdhc7\r\u001d\u0166\u0099\ufffd\ufffd\u0352z\ufffd_T8\ufffd \ufffd\/\ufffd\ufffd+\u0503C\ufffd\|\ufffdn9\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\ufffdq\ufffd\ufffd\ufffd)N1 \ud8ec\udfe3\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001f", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\ufffd \ufffdU\u001c\u0007\ufffd\u000b$\ufffdL3\ufffdhc7\r\u001d\u0166\u0099\ufffd\ufffd\u0352z\ufffd_T8\ufffd \ufffd\/\ufffd\ufffd+\u0503C\ufffd\|\ufffdn9\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\ufffdq\ufffd\ufffd\ufffd)N1 \ud8ec\udfe3\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001f\u0000 uD\ufffd\ufffd\ufffdH\ufffdp\ufffd\ufffd\u0005\u0006\ufffd\u06b7l\ufffdN\ufffd7\ufffd\/\ufffd\ufffdq\ufffd\ufffd\ufffdB\ufffdZ\u0000\ufffd\ufffd)\ufffd7Hr\ufffd\ub085M\u0000c\ufffd\u0014\u0013\ufffd\ufffdr\ufffd\ufffd\ufffd\|z\"\ufffd'\ufffd;\ufffd\ufffd\ufffdQ\ufffd\u000bK\u0011\ufffdRQQ\u0011\u0003\ufffd\ufffd\u0015\ufffd\u05e1_\")\ufffda\ufffd\ufffd9\ufffd\n\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\u000eQ\u045e\ufffd\/!\ufffd\ufffd\u0012\u000fZ\ufffd\u0007-\ufffdS#\ufffd4\ufffd\ufffd\ufffd\ufffd\u001a", "payload_snippet": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\ufffd \ufffdU\u001c\u0007\ufffd\u000b$\ufffdL3\ufffdhc7\r\u001d\u0166\u0099\ufffd\ufffd\u0352z\ufffd_T8\ufffd \ufffd\/\ufffd\ufffd+\u0503C\ufffd\|\ufffdn9\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\ufffdq\ufffd\ufffd\ufffd)N1 \ud8ec\udfe3\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001f", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fc5e62705a70795a003953062842e9522196b7a9", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\ufffd \ufffdU\u001c\u0007\ufffd\u000b$\ufffdL3\ufffdhc7\r\u001d\u0166\u0099\ufffd\ufffd\u0352z\ufffd_T8\ufffd \ufffd\/\ufffd\ufffd+\u0503C\ufffd\|\ufffdn9\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\ufffdq\ufffd\ufffd\ufffd)N1 \ud8ec\udfe3\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001f", "tls_ja3": "3642a49605ec090cad5d943bbe79400d", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 3071, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd \ufffdU\ufffd$\ufffdL3\ufffdhc7\r\u0166\u0099\ufffd\ufffd\u0352z\ufffd_T8\ufffd \ufffd\/\ufffd\ufffd+\u0503C\ufffd\|\ufffdn9\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffd)N1 \ud8ec\udfe3 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd\r\ufffdf", "attack_vector": "tls probe \u00b7 via TLS:3071 \u00b7 (sonde \/ probe)", "target_port_label": "3071 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 3071, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\ufffd \ufffdU\u001c\u0007\ufffd\u000b$\ufffdL3\ufffdhc7\r\u001d\u0166\u0099\ufffd\ufffd\u0352z\ufffd_T8\ufffd \ufffd\/\ufffd\ufffd+\u0503C\ufffd\|\ufffdn9\ufffd\ufffd\ufffd\ufffd\u0007\ufffd\ufffdq\ufffd\ufffd\ufffd)N1 \ud8ec\udfe3\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001f", "tls_ja3": "3642a49605ec090cad5d943bbe79400d", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 3071, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:3071 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd \ufffdU\ufffd$\ufffdL3\ufffdhc7\r\u0166\u0099\ufffd\ufffd\u0352z\ufffd_T8\ufffd \ufffd\/\ufffd\ufffd+\u0503C\ufffd\|\ufffdn9\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdq\ufffd\ufffd\ufffd)N1 \ud8ec\udfe3 \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd\r\ufffdf", "target_port_label": "3071 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "3071" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }
06/08/2026 14:51:44 UTC	TCP	3071 · TLS	tls	Sonde TLS tls probe · via TLS:3071 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 2b91617a55f2a4d9 SNI www.blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI www.blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 3071 Chemin / cible — Service TLS SNI TLS www.blacklistip.com Payload 62�N�=\|��47� ^�"��k8<�`�bG�5 8�x�cd��x��(�� Ͻ�� +�/�,�0̨̩��/5ɚ� Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0607 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) 62�N�=\|��47�^�"��k8<�`�bG�5 8�x�cd��x��(��Ͻ�� +�/�,�0̨̩��/5ɚ� Requête brute (extrait) 62�N�=\|��47� ^�"��k8<�`�bG�5 8�x�cd��x��(�� Ͻ�� +�/�,�0̨̩��/5ɚ� + ��#Dih2- h2http/1.13+)�� h��O �[B��NzR� ��\|^Y'2E0 Meta JSON brut { "tls_ja3_hash": "2b91617a55f2a4d9fb5e0ae71f7872c3", "tls_sni": "www.blacklistip.com", "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 571, "payload_entropy": 6.915852047315395, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 3071, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "ab1c13e93cf7758e522da7b6e5a37295a67dd3f4", "event_fingerprint": "5fdba2b75c7f625d9f7557a52d7f73fe07faee50", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0607" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "2b91617a55f2a4d9fb5e0ae71f7872c3", "payload_hash": "5799f54e99c2c96f3659964b39e182b2", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "www.blacklistip.com" }, "target_context": { "dst_port": 3071, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\u0019N\ufffd=\|\ufffd\ufffd\ufffd47\ufffd\f^\ufffd\"\ufffd\ufffd\ufffdk\u001a8<\ufffd`\ufffdbG\u0014\ufffd5 8\ufffdx\ufffdc\u0007d\ufffd\u001b\ufffd\ufffdx\u0019\ufffd\ufffd(\u0011\ufffd\ufffd\ufffd\u0003\u0017\ufffd\ufffd\f\u03fd\ufffd\ufffd\ufffd\u0014\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u025a\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\u0019N\ufffd=\|\ufffd\ufffd\ufffd47\ufffd\f^\ufffd\"\ufffd\ufffd\ufffdk\u001a8<\ufffd`\ufffdbG\u0014\ufffd5 8\ufffdx\ufffdc\u0007d\ufffd\u001b\ufffd\ufffdx\u0019\ufffd\ufffd(\u0011\ufffd\ufffd\ufffd\u0003\u0017\ufffd\ufffd\f\u03fd\ufffd\ufffd\ufffd\u0014\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u025a\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000\u0000+\u0000\u0007\u0006\n\n\u0003\u0004\u0003\u0003\u0000\n\u0000\n\u0000\b\ufffd\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000#\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000-\u0000\u0002\u0001\u0001\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0012\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u00003\u0000+\u0000)\ufffd\ufffd\u0000\u0001\u0000\u0000\u001d\u0000 \b\u001f\ufffd\ufffd\ufffdh\u0019\ufffd\ufffdO\n\ufffd[B\ufffd\ufffdNzR\u001b\ufffd\t\ufffd\ufffd\u0016\|^Y'2E0\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000", "payload_snippet": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\u0019N\ufffd=\|\ufffd\ufffd\ufffd47\ufffd\f^\ufffd\"\ufffd\ufffd\ufffdk\u001a8<\ufffd`\ufffdbG\u0014\ufffd5 8\ufffdx\ufffdc\u0007d\ufffd\u001b\ufffd\ufffdx\u0019\ufffd\ufffd(\u0011\ufffd\ufffd\ufffd\u0003\u0017\ufffd\ufffd\f\u03fd\ufffd\ufffd\ufffd\u0014\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u025a\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "945078da234667feab855a94675eacc113b87b85", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\u0019N\ufffd=\|\ufffd\ufffd\ufffd47\ufffd\f^\ufffd\"\ufffd\ufffd\ufffdk\u001a8<\ufffd`\ufffdbG\u0014\ufffd5 8\ufffdx\ufffdc\u0007d\ufffd\u001b\ufffd\ufffdx\u0019\ufffd\ufffd(\u0011\ufffd\ufffd\ufffd\u0003\u0017\ufffd\ufffd\f\u03fd\ufffd\ufffd\ufffd\u0014\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u025a\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000", "tls_ja3": "2b91617a55f2a4d9fb5e0ae71f7872c3", "tls_sni": "www.blacklistip.com", "port": 3071, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "62\ufffdN\ufffd=\|\ufffd\ufffd\ufffd47\ufffd^\ufffd\"\ufffd\ufffd\ufffdk8<\ufffd`\ufffdbG\ufffd5 8\ufffdx\ufffdcd\ufffd\ufffd\ufffdx\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\u03fd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\u025a\ufffd", "attack_vector": "tls probe \u00b7 via TLS:3071 \u00b7 (sonde \/ probe)", "target_port_label": "3071 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 3071, "protocol_emulated": null, "tags_summary": [ "pat-0607" ], "tags_summary_labels_fr": [ "pat-0607" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\u0019N\ufffd=\|\ufffd\ufffd\ufffd47\ufffd\f^\ufffd\"\ufffd\ufffd\ufffdk\u001a8<\ufffd`\ufffdbG\u0014\ufffd5 8\ufffdx\ufffdc\u0007d\ufffd\u001b\ufffd\ufffdx\u0019\ufffd\ufffd(\u0011\ufffd\ufffd\ufffd\u0003\u0017\ufffd\ufffd\f\u03fd\ufffd\ufffd\ufffd\u0014\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u025a\ufffd\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\u0017\u0000\u0000", "tls_ja3": "2b91617a55f2a4d9fb5e0ae71f7872c3", "tls_sni": "www.blacklistip.com", "port": 3071, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:3071 \u00b7 (sonde \/ probe)", "evidence_snippet": "62\ufffdN\ufffd=*\|\ufffd\ufffd\ufffd47\ufffd^\ufffd\"\ufffd\ufffd\ufffdk8<\ufffd`\ufffdbG\ufffd5 8\ufffdx\ufffdcd\ufffd\ufffd\ufffdx\ufffd\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\u03fd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\u025a\ufffd", "target_port_label": "3071 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "3071" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }
06/08/2026 14:34:20 UTC	TCP	8808 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:8808 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 20b279993ae2e137 SNI blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 Cible HTTP — TLS SNI blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 8808 Chemin / cible — Service TLS SNI TLS blacklistip.com Payload ��j蠳`p T��[w��h�gG�E߳c�� >h�0��JW��Wۼ��Bq%��+�/�,�0̨̩� �� wblacklistip Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��j蠳`pT��[w��h�gG�E߳c�� >h�0��JW��Wۼ��Bq%��+�/�,�0̨̩� �� wblacklistip Requête brute (extrait) ��j蠳`p T��[w��h�gG�E߳c�� >h�0��JW��Wۼ��Bq%��+�/�,�0̨̩� �� wblacklistip.com � � 2+ 3��% Meta JSON brut { "tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "blacklistip.com", "bytes_in": 1507, "payload_entropy": 7.762168345170723, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 8808, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "0a9b3f93937ad2bc2685dfc8264a894eef59e224", "event_fingerprint": "e32d7cf82b56bd1ef234d96dc6ee737ce0518bf6", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "20b279993ae2e137e62b9647c6d768fb", "payload_hash": "322254b37cfe1732d64d4b9343d80700", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "tls_sni": "blacklistip.com" }, "target_context": { "dst_port": 8808, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdj\u8833`p\fT\ufffd\ufffd[w\ufffd\ufffd\ufffdh\ufffdgG\ufffdE\u07f3c\ufffd\ufffd\u001e\ufffd \ufffd>h\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffdJW\ufffd\ufffdW\u06fc\ufffd\ufffd\ufffd\ufffd\u0004Bq%\ufffd\u0017\ufffd\ufffd\u0005\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdj\u8833`p\fT\ufffd\ufffd[w\ufffd\ufffd\ufffdh\ufffdgG\ufffdE\u07f3c\ufffd\ufffd\u001e\ufffd \ufffd>h\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffdJW\ufffd\ufffdW\u06fc\ufffd\ufffd\ufffd\ufffd\u0004Bq%\ufffd\u0017\ufffd\ufffd\u0005\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip.com\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd%", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdj\u8833`p\fT\ufffd\ufffd[w\ufffd\ufffd\ufffdh\ufffdgG\ufffdE\u07f3c\ufffd\ufffd\u001e\ufffd \ufffd>h\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffdJW\ufffd\ufffdW\u06fc\ufffd\ufffd\ufffd\ufffd\u0004Bq%\ufffd\u0017\ufffd\ufffd\u0005\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "24a1e08f6f962fc5cdda59636047c170bd2d2091", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdj\u8833`p\fT\ufffd\ufffd[w\ufffd\ufffd\ufffdh\ufffdgG\ufffdE\u07f3c\ufffd\ufffd\u001e\ufffd \ufffd>h\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffdJW\ufffd\ufffdW\u06fc\ufffd\ufffd\ufffd\ufffd\u0004Bq%\ufffd\u0017\ufffd\ufffd\u0005\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "blacklistip.com", "port": 8808, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdj\u8833`pT\ufffd\ufffd[w\ufffd\ufffd\ufffdh\ufffdgG\ufffdE\u07f3c\ufffd\ufffd\ufffd \ufffd>h\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffdJW\ufffd\ufffdW\u06fc\ufffd\ufffd\ufffd\ufffdBq%\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdwblacklistip", "attack_vector": "postgres probe \u00b7 via TLS:8808 \u00b7 (sonde \/ probe)", "target_port_label": "8808 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8808, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdj\u8833`p\fT\ufffd\ufffd[w\ufffd\ufffd\ufffdh\ufffdgG\ufffdE\u07f3c\ufffd\ufffd\u001e\ufffd \ufffd>h\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffdJW\ufffd\ufffdW\u06fc\ufffd\ufffd\ufffd\ufffd\u0004Bq%\ufffd\u0017\ufffd\ufffd\u0005\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "blacklistip.com", "port": 8808, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:8808 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdj\u8833`pT\ufffd\ufffd[w\ufffd\ufffd\ufffdh\ufffdgG\ufffdE\u07f3c\ufffd\ufffd\ufffd \ufffd>h\ufffd0\ufffd\ufffd\ufffd\ufffd\ufffdJW\ufffd\ufffdW\u06fc\ufffd\ufffd\ufffd\ufffdBq%\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdwblacklistip", "target_port_label": "8808 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8808" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3" ] }
06/08/2026 14:03:21 UTC	TCP	447	—	Sonde Kafka kafka probe · port 447 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 447 Chemin / cible — Payload �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Requête brute (extrait) �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� # h2http/1.1 3&$ sH?�ߑ��`��%�ϋ5��߅�wM��-+ Meta JSON brut { "bytes_in": 520, "payload_entropy": 3.999375592941219, "port_category": "well_known", "org": "Zenlayer Inc", "service": null, "app_proto": null, "asn": 62610, "country": "US", "dst_port": 447, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.1, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "bd5c6c79a9415e74772a5e57dad5d82a369b1eb2", "event_fingerprint": "4c135145fafbf794098e2e2cdbdaee0e6274f4cf", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3406a76f136d489bc5c37b989c06ec84", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 447, "risk_score": 32 }, "payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003", "payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "393d4a3c5752fb30ff1a6388111358e7b72e89de", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 447 }, "evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 port 447 \u00b7 (sonde \/ probe)", "target_port_label": "447", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 447, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 447 }, "attack_vector": "kafka probe \u00b7 port 447 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "target_port_label": "447", "emulator_service": null, "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "447" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
06/08/2026 13:47:07 UTC	TCP	2078	—	Sonde Kafka kafka probe · port 2078 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2078 Chemin / cible — Payload ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Requête brute (extrait) ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� # h2http/1.1 3&$ sH?�ߑ��`��%�ϋ5��߅�wM��-+ Meta JSON brut { "bytes_in": 501, "payload_entropy": 3.7940870380940184, "port_category": "registered", "org": "Zenlayer Inc", "service": null, "app_proto": null, "asn": 62610, "country": "US", "dst_port": 2078, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 0.2, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "1950897cdf5c623ca137b6961ae3e9ab8073e242", "event_fingerprint": "fe4076eb8064813c8708b6e0d01947d5de16950c", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "29b5329f45e73a6677bca0caf0ca278c", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 2078, "risk_score": 32 }, "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003", "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "d93edb71d703d7381fcd9d5404e341d347518513", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 2078 }, "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 port 2078 \u00b7 (sonde \/ probe)", "target_port_label": "2078", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 2078, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 2078 }, "attack_vector": "kafka probe \u00b7 port 2078 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "target_port_label": "2078", "emulator_service": null, "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "2078" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
06/08/2026 13:40:23 UTC	TCP	5800 · TLS	tls	Sonde TLS tls probe · via TLS:5800 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 c2b3f295508ddeaa Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5800 Chemin / cible — Service TLS Payload ��AR�g^��^�[lZ�4�Th[�[ �F�b��Ox�߄��W��H��ă � ��+�/�,�0̨̩��/5��-+ Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��AR�g^��^�[lZ�4�Th[�[ �F�b��Ox�߄��W��H��ă � ��+�/�,�0̨̩��/5��-+ Requête brute (extrait) ��AR�g^��^�[lZ�4�Th[�[ �F�b��Ox�߄��W��H��ă � ��+�/�,�0̨̩��/5��-+��Dih2 h2http/1.13+):: 2$\|��#�XZ�"`��Qhǫ�-Y�X��z� �� Uf�X��_�ZTڕ Meta JSON brut { "tls_ja3_hash": "c2b3f295508ddeaa87216e60537ebcb9", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 511, "payload_entropy": 6.886452515970853, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 5800, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "44009d2a7fd67acff0b8dc318ddf3708ce368967", "event_fingerprint": "b8ab7aff2b405c5e820ad933f89c22005667e0f6", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "c2b3f295508ddeaa87216e60537ebcb9", "payload_hash": "0333c1d637920215cd0b8193422e8850", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 5800, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdAR\ufffdg^\ufffd\u0019\ufffd\u0005\ufffd\u001c^\u0001\ufffd[l\u0019\u0005Z\ufffd4\ufffdTh\u001b[\u0012\u0015\ufffd[ \ufffd\u0005F\ufffd\u001cb\ufffd\ufffdOx\ufffd\u07c4\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffdW\ufffd\ufffd\ufffdH\ufffd\u0010\ufffd\u0103 \ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0007", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdAR\ufffdg^\ufffd\u0019\ufffd\u0005\ufffd\u001c^\u0001\ufffd[l\u0019\u0005Z\ufffd4\ufffdTh\u001b[\u0012\u0015\ufffd[ \ufffd\u0005F\ufffd\u001cb\ufffd\ufffdOx\ufffd\u07c4\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffdW\ufffd\ufffd\ufffdH\ufffd\u0010\ufffd\u0103 \ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003\u0003\u0000\u001b\u0000\u0003\u0002\u0000\u0002Di\u0000\u0005\u0000\u0003\u0002h2\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u00003\u0000+\u0000)::\u0000\u0001\u0000\u0000\u001d\u0000 2$\|\ufffd\ufffd\ufffd\ufffd#\ufffdXZ\ufffd\"`\u001e\ufffd\ufffd\u0006Qh\u01eb\ufffd-Y\u001f\ufffdX\ufffd\ufffd\ufffdz\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \ufffd\ufffdUf\ufffdX\ufffd\ufffd\ufffd_\ufffdZT\u0695", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdAR\ufffdg^\ufffd\u0019\ufffd\u0005\ufffd\u001c^\u0001\ufffd[l\u0019\u0005Z\ufffd4\ufffdTh\u001b[\u0012\u0015\ufffd[ \ufffd\u0005F\ufffd\u001cb\ufffd\ufffdOx\ufffd\u07c4\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffdW\ufffd\ufffd\ufffdH\ufffd\u0010\ufffd\u0103 \ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0007", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "79ba7e24aec58b3f2c38cd117d0ad8d5e352173e", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdAR\ufffdg^\ufffd\u0019\ufffd\u0005\ufffd\u001c^\u0001\ufffd[l\u0019\u0005Z\ufffd4\ufffdTh\u001b[\u0012\u0015\ufffd[ \ufffd\u0005F\ufffd\u001cb\ufffd\ufffdOx\ufffd\u07c4\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffdW\ufffd\ufffd\ufffdH\ufffd\u0010\ufffd\u0103 \ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0007", "tls_ja3": "c2b3f295508ddeaa87216e60537ebcb9", "port": 5800, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffdAR\ufffdg^\ufffd\ufffd\ufffd^\ufffd[lZ\ufffd4\ufffdTh[\ufffd[ \ufffdF\ufffdb\ufffd\ufffdOx\ufffd\u07c4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdH\ufffd\ufffd\u0103 \ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd-+", "attack_vector": "tls probe \u00b7 via TLS:5800 \u00b7 (sonde \/ probe)", "target_port_label": "5800 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 5800, "protocol_emulated": null, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\ufffdAR\ufffdg^\ufffd\u0019\ufffd\u0005\ufffd\u001c^\u0001\ufffd[l\u0019\u0005Z\ufffd4\ufffdTh\u001b[\u0012\u0015\ufffd[ \ufffd\u0005F\ufffd\u001cb\ufffd\ufffdOx\ufffd\u07c4\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\ufffdW\ufffd\ufffd\ufffdH\ufffd\u0010\ufffd\u0103 \ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\u0007", "tls_ja3": "c2b3f295508ddeaa87216e60537ebcb9", "port": 5800, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:5800 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdAR\ufffdg^\ufffd\ufffd\ufffd^\ufffd[lZ\ufffd4\ufffd*Th[\ufffd[ \ufffdF\ufffdb\ufffd\ufffdOx\ufffd\u07c4\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffdH\ufffd\ufffd\u0103 \ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd-+", "target_port_label": "5800 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "5800" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "port:5800", "port:8882", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
06/08/2026 13:40:20 UTC	TCP	5800	—	Sonde Kafka kafka probe · port 5800 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5800 Chemin / cible — Payload ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 55% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Requête brute (extrait) ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� # h2http/1.1 3&$ sH?�ߑ��`��%�ϋ5��߅�wM��-+ Meta JSON brut { "bytes_in": 516, "payload_entropy": 3.9791255536617784, "port_category": "registered", "org": "Zenlayer Inc", "service": null, "app_proto": null, "asn": 62610, "country": "US", "dst_port": 5800, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 0.5, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "5c67bb6434a94dc920e707aa0b53ca870b0346bb", "event_fingerprint": "378a38e20b012996744d4458dfc435e9ec8050c5", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a2a0ad11f9f8f1cf9217197b97b6f064", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 5800, "risk_score": 32 }, "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003", "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "957d404d7912d624c1c472b58d18699fc558774e", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 5800 }, "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 port 5800 \u00b7 (sonde \/ probe)", "target_port_label": "5800", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 5800, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 5800 }, "attack_vector": "kafka probe \u00b7 port 5800 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "target_port_label": "5800", "emulator_service": null, "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "5800" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 3, "multi_protocol_sample": [ "port:5800", "port:8882", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
06/08/2026 13:37:30 UTC	TCP	8882 · TLS	tls	Sonde TLS tls probe · via TLS:8882 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 5ff4aa95b2562d2b SNI ip-62-3-50-33.v4.isp.servpersosystems.net Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI ip-62-3-50-33.v4.isp.servpersosystems.net Capteur paris-1
Preuve / Evidence Méthode — Port 8882 Chemin / cible — Service TLS SNI TLS ip-62-3-50-33.v4.isp.servpersosystems.net Payload n�;"�7xz��S��2�n��\�ЗkP� Z(�؃�͊X�I]�z�!A�J�^;$sʑ�MN� ��+�/�,�0̨̩��/5�� Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) n�;"�7xz��S��2�n��\�ЗkP� Z(�؃�͊X�I]�z�!A�J�^;$sʑ�MN� ��+�/�,�0̨̩��/5�� Requête brute (extrait) n�;"�7xz��S��2�n��\�ЗkP� Z(�؃�͊X�I]�z�!A�J�^;$sʑ�MN� ��+�/�,�0̨̩��/5�� ]�]�m^zT]"��E4��?�p�6C�b��Z �D��ia\|�ї7�Ue�>��J�TP fzu�Q��I��-r�{l��]@��W��ژ�o+\7 Meta JSON brut { "tls_ja3_hash": "5ff4aa95b2562d2b77b93af794413476", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 529, "payload_entropy": 6.743476171705565, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 8882, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "d15fe25aec83d1f1fa21d8f8d2f5f0168f12cb7b", "event_fingerprint": "891f6ac1a9dc2799fbc2ab3a01fcd4caa9065c08", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "5ff4aa95b2562d2b77b93af794413476", "payload_hash": "5d5f0dc425898c68f80c500010c2b437", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net" }, "target_context": { "dst_port": 8882, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003n\ufffd;\"\ufffd7xz\ufffd\ufffdS\ufffd\u001d\u0010\ufffd\u001c2\ufffd\u0014n\ufffd\ufffd\\\ufffd\u0417kP\ufffd Z(\ufffd\u0603\ufffd\u034aX\ufffdI]\ufffdz\ufffd!A\ufffdJ\u0012\ufffd^;$s\u0291\u0003\ufffdMN\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003n\ufffd;\"\ufffd7xz\ufffd\ufffdS\ufffd\u001d\u0010\ufffd\u001c2\ufffd\u0014n\ufffd\ufffd\\\ufffd\u0417kP\ufffd Z(\ufffd\u0603\ufffd\u034aX\ufffdI]\ufffdz\ufffd!A\ufffdJ\u0012\ufffd^;$s\u0291\u0003\ufffdMN\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000\u001b\u0000\u0003\u0002\u0000\u0002\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \r]\ufffd]\ufffdm^z\u001fT]\"\u0002\u000e\ufffd\u001e\ufffd\ufffdE4\ufffd\ufffd?\ufffdp\ufffd\u00036C\ufffdb\u0000\ufffd\ufffd\ufffd\u0003Z\n\ufffd\bD\ufffd\ufffd\bia\u001c\|\u0005\ufffd\u001d\u04577\ufffdUe\ufffd>\ufffd\ufffd\ufffd\ufffdJ\ufffd\u000fTP\rfzu\ufffdQ\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffd\ufffd-r\ufffd{l\ufffd\ufffd\ufffd\ufffd]@\ufffd\ufffdW\ufffd\ufffd\u0698\ufffdo+\\7", "payload_snippet": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003n\ufffd;\"\ufffd7xz\ufffd\ufffdS\ufffd\u001d\u0010\ufffd\u001c2\ufffd\u0014n\ufffd\ufffd\\\ufffd\u0417kP\ufffd Z(\ufffd\u0603\ufffd\u034aX\ufffdI]\ufffdz\ufffd!A\ufffdJ\u0012\ufffd^;$s\u0291\u0003\ufffdMN\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a1644eb2c53ef4be97772d41d03a1791c225ff6c", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003n\ufffd;\"\ufffd7xz\ufffd\ufffdS\ufffd\u001d\u0010\ufffd\u001c2\ufffd\u0014n\ufffd\ufffd\\\ufffd\u0417kP\ufffd Z(\ufffd\u0603\ufffd\u034aX\ufffdI]\ufffdz\ufffd!A\ufffdJ\u0012\ufffd^;$s\u0291\u0003\ufffdMN\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "5ff4aa95b2562d2b77b93af794413476", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 8882, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "n\ufffd;\"\ufffd7xz\ufffd\ufffdS\ufffd\ufffd2\ufffdn\ufffd\ufffd\\\ufffd\u0417kP\ufffd Z(\ufffd\u0603\ufffd\u034aX\ufffdI]\ufffdz\ufffd!A\ufffdJ\ufffd^;$s\u0291\ufffdMN\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd", "attack_vector": "tls probe \u00b7 via TLS:8882 \u00b7 (sonde \/ probe)", "target_port_label": "8882 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8882, "protocol_emulated": null, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003n\ufffd;\"\ufffd7xz\ufffd\ufffdS\ufffd\u001d\u0010\ufffd\u001c2\ufffd\u0014n\ufffd\ufffd\\\ufffd\u0417kP\ufffd Z(\ufffd\u0603\ufffd\u034aX\ufffdI]\ufffdz\ufffd!A\ufffdJ\u0012\ufffd^;$s\u0291\u0003\ufffdMN\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\ufffd\ufffd\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000", "tls_ja3": "5ff4aa95b2562d2b77b93af794413476", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 8882, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:8882 \u00b7 (sonde \/ probe)", "evidence_snippet": "n\ufffd;\"\ufffd7xz\ufffd\ufffdS\ufffd\ufffd2\ufffdn*\ufffd\ufffd\\\ufffd\u0417kP\ufffd Z(\ufffd\u0603\ufffd\u034aX\ufffdI]\ufffdz\ufffd!A\ufffdJ\ufffd^;$s\u0291\ufffdMN\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd\ufffd\ufffd\ufffd", "target_port_label": "8882 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8882" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "port:8882", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }
06/08/2026 13:37:28 UTC	TCP	8882	—	Sonde Kafka kafka probe · port 8882 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8882 Chemin / cible — Payload �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Requête brute (extrait) �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� # h2http/1.1 3&$ sH?�ߑ��`��%�ϋ5��߅�wM��-+ Meta JSON brut { "bytes_in": 520, "payload_entropy": 3.999375592941219, "port_category": "registered", "org": "Zenlayer Inc", "service": null, "app_proto": null, "asn": 62610, "country": "US", "dst_port": 8882, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "5158132f4e26a64058e1280324f3d1c585c96fc4", "event_fingerprint": "9804da3c002967109d9f6881ad267bd8ea8f65c3", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3406a76f136d489bc5c37b989c06ec84", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 8882, "risk_score": 32 }, "payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003", "payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1ceacb651ddbf7236112b6d4dea965f0bf28377b", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 8882 }, "evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 port 8882 \u00b7 (sonde \/ probe)", "target_port_label": "8882", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 8882, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 8882 }, "attack_vector": "kafka probe \u00b7 port 8882 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "target_port_label": "8882", "emulator_service": null, "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "8882" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
06/08/2026 13:29:11 UTC	TCP	8381	—	Sonde Kafka kafka probe · port 8381 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8381 Chemin / cible — Payload ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 55% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Requête brute (extrait) ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� # h2http/1.1 3&$ sH?�ߑ��`��%�ϋ5��߅�wM��-+ Meta JSON brut { "bytes_in": 516, "payload_entropy": 3.9791255536617784, "port_category": "registered", "org": "Zenlayer Inc", "service": null, "app_proto": null, "asn": 62610, "country": "US", "dst_port": 8381, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "8d6ee96ca72c5057e3f5267d7041310476c2b0ed", "event_fingerprint": "99e2869b28ab9d130a72ff0ddf89b6fad8d0e54e", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a2a0ad11f9f8f1cf9217197b97b6f064", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 8381, "risk_score": 32 }, "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003", "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e1ca1f76db10eef7246e619ba09e66c04cc98e86", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 8381 }, "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 port 8381 \u00b7 (sonde \/ probe)", "target_port_label": "8381", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 8381, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 8381 }, "attack_vector": "kafka probe \u00b7 port 8381 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "target_port_label": "8381", "emulator_service": null, "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "8381" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "port:8381", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
06/08/2026 13:29:05 UTC	TCP	8381 · TLS	tls	Sonde TLS tls probe · via TLS:8381 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 83cafa166c82a2b1 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8381 Chemin / cible — Service TLS Payload :6h��r��t�,�s��i��²�ڂe� 4�&��Q<��L.n�v��e�)(\|��H ��+�/�,�0̨̩��/5�::+� Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) :6h��r��t�,�s��i��²�ڂe� 4�&��Q<��L.n�v��e�)(\|��H ��+�/�,�0̨̩��/5�::+� Requête brute (extrait) :6h��r��t�,�s��i��²�ڂe� 4�&��Q<��L.n�v��e�)(\|��H ��+�/�,�0̨̩��/5�::+�� - �5UN��n�p�7M��V+ZRx)c+}��i4k��f�V��.Wϵf��&❢��ƋTPzL�EI�㘄�<��-�;�i��1��ѵe��".�`��w� Meta JSON brut { "tls_ja3_hash": "83cafa166c82a2b12a47f042c7c94a06", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 575, "payload_entropy": 7.023556790168638, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 8381, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 2.8, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "ffcc1c6f03370d696ac4fe1dfcd4c543447ef178", "event_fingerprint": "85d219564db7fa9f472ff377dcd22eba3bbfee05", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "83cafa166c82a2b12a47f042c7c94a06", "payload_hash": "c7c2f8d3943671718b18528290f80dae", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 8381, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_preview": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffd\b\u0007\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffd\u001c\u001ei\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\b\ufffd\u0017\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(\|\u0013\ufffd\ufffdH\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd", "request_sample": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffd\b\u0007\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffd\u001c\u001ei\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\b\ufffd\u0017\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(\|\u0013\ufffd\ufffdH\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003\u0003\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001-\u0000 \ufffd5\u0011UN\u0004\ufffd\ufffd\ufffdn\ufffdp\ufffd7M\ufffd\ufffd\ufffd\ufffd\ufffdV+ZRx\u0001\u0007\u0003)c+}\u0000\ufffd\ufffd\ufffdi4k\ufffd\ufffdf\ufffdV\ufffd\ufffd.W\u03f5\u0013f\ufffd\ufffd\ufffd&\u2762\ufffd\ufffd\u018bTPzL\ufffdEI\ufffd\u3604\u0018\ufffd<\ufffd\ufffd-\ufffd;\ufffdi\ufffd\ufffd\ufffd\ufffd\u001c\ufffd1\ufffd\ufffd\u0475e\ufffd\ufffd\ufffd\".\ufffd`\ufffd\ufffdw\ufffd\r\u0015", "payload_snippet": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffd\b\u0007\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffd\u001c\u001ei\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\b\ufffd\u0017\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(\|\u0013\ufffd\ufffdH\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffd\b\u0007\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffd\u001c\u001ei\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\b\ufffd\u0017\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(\|\u0013\ufffd\ufffdH\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003\u0003\ufffd\r\u0001\u001a\u0000\u0000\u0001\u0000\u0001-\u0000 \ufffd5\u0011UN\u0004\ufffd\ufffd\ufffdn\ufffdp\ufffd7M\ufffd\ufffd\ufffd\ufffd\ufffdV+ZRx\u0001\u0007\u0003)c+}\u0000\ufffd\ufffd\ufffdi4k\ufffd\ufffdf\ufffdV\ufffd\ufffd.W\u03f5\u0013f\ufffd\ufffd\ufffd&\u2762\ufffd\ufffd\u018bTPzL\ufffdEI\ufffd\u3604\u0018\ufffd<\ufffd\ufffd-\ufffd;\ufffdi\ufffd\ufffd\ufffd\ufffd\u001c\ufffd1\ufffd\ufffd\u0475e\ufffd\ufffd\ufffd\".\ufffd`\ufffd\ufffdw\ufffd\r\u0015", "payload_snippet": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffd\b\u0007\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffd\u001c\u001ei\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\b\ufffd\u0017\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(\|\u0013\ufffd\ufffdH\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cd2894a9828b22426de1fd0a22f658593aba8648", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffd\b\u0007\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffd\u001c\u001ei\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\b\ufffd\u0017\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(\|\u0013\ufffd\ufffdH\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd", "tls_ja3": "83cafa166c82a2b12a47f042c7c94a06", "port": 8381, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": ":6h\ufffd\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(\|\ufffd\ufffdH \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::+\ufffd", "attack_vector": "tls probe \u00b7 via TLS:8381 \u00b7 (sonde \/ probe)", "target_port_label": "8381 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8381, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002:\u0001\u0000\u00026\u0003\u0003h\ufffd\b\u0007\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffd\u001c\u001ei\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\b\ufffd\u0017\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(\|\u0013\ufffd\ufffdH\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd::\u0000\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd", "tls_ja3": "83cafa166c82a2b12a47f042c7c94a06", "port": 8381, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:8381 \u00b7 (sonde \/ probe)", "evidence_snippet": ":6h\ufffd\ufffd\ufffdr\ufffd\ufffdt\ufffd,\ufffds\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\ufffd\u00b2\ufffd\u0682e\ufffd 4\ufffd&\ufffd\ufffdQ<\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdL.n\ufffdv\ufffd\ufffde\ufffd)(\|\ufffd\ufffdH \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffd::+\ufffd", "target_port_label": "8381 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8381" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
06/08/2026 12:25:50 UTC	TCP	8852 · TLS	tls	Sonde TLS tls probe · via TLS:8852 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 9c0ebf3a1c43cd47 SNI ip-62-3-50-33.v4.isp.servpersosystems.net Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI ip-62-3-50-33.v4.isp.servpersosystems.net Capteur paris-1
Preuve / Evidence Méthode — Port 8852 Chemin / cible — Service TLS SNI TLS ip-62-3-50-33.v4.isp.servpersosystems.net Payload Ӟ�&� �^�/i�.�4X��x{jB%>6�d�< Ȑd�>a&ߞ�7��^Ҁ�t��+�}F�� +�/�,�0̨̩��/5�zz� Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) Ӟ�&� �^�/i�.�4X��x{jB%>6�d�< Ȑd�>a&ߞ�7��^Ҁ�t��+�}F�� +�/�,�0̨̩��/5�zz� Requête brute (extrait) Ӟ�&� �^�/i�.�4X��x{jB%>6�d�< Ȑd�>a&ߞ�7��^Ҁ�t��+�}F�� +�/�,�0̨̩��/5�zz� -Dih2.,)ip-62-3-50-33.v4.isp.servpersosystems.net h2http/1.1+ Meta JSON brut { "tls_ja3_hash": "9c0ebf3a1c43cd475c2d383c5063cd3a", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 529, "payload_entropy": 6.834079908596782, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 8852, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "3619c69734eeea88cd5bfd2fe046e9f368689fd5", "event_fingerprint": "737cabfe0db76937f3a3ddf1dc4b8d5ad94c7ac2", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "9c0ebf3a1c43cd475c2d383c5063cd3a", "payload_hash": "f792c9744a6c6acaded71ca3925c1cb9", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net" }, "target_context": { "dst_port": 8852, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\u04de\ufffd&\ufffd\r\ufffd^\ufffd\u0001\/\u0000i\ufffd.\ufffd4X\ufffd\ufffdx{jB%>\u00166\ufffdd\ufffd< \u0210d\ufffd>a&\u001d\u07de\ufffd7\ufffd\ufffd\u0019^\u0480\ufffd\u0017\u0000t\ufffd\u0015\ufffd+\ufffd}F\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdzz\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\u04de\ufffd&\ufffd\r\ufffd^\ufffd\u0001\/\u0000i\ufffd.\ufffd4X\ufffd\ufffdx{jB%>\u00166\ufffdd\ufffd< \u0210d\ufffd>a&\u001d\u07de\ufffd7\ufffd\ufffd\u0019^\u0480\ufffd\u0017\u0000t\ufffd\u0015\ufffd+\ufffd}F\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdzz\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000\b\n\n\u0000\u001d\u0000\u0017\u0000\u0018\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000-\u0000\u0002\u0001\u0001Di\u0000\u0005\u0000\u0003\u0002h2\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-33.v4.isp.servpersosystems.net\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000+\u0000\u0007\u0006", "payload_snippet": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\u04de\ufffd&\ufffd\r\ufffd^\ufffd\u0001\/\u0000i\ufffd.\ufffd4X\ufffd\ufffdx{jB%>\u00166\ufffdd\ufffd< \u0210d\ufffd>a&\u001d\u07de\ufffd7\ufffd\ufffd\u0019^\u0480\ufffd\u0017\u0000t\ufffd\u0015\ufffd+\ufffd}F\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdzz\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "08d91adf50302b0f571e6ff0541aac7eac7d69b2", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\u04de\ufffd&\ufffd\r\ufffd^\ufffd\u0001\/\u0000i\ufffd.\ufffd4X\ufffd\ufffdx{jB%>\u00166\ufffdd\ufffd< \u0210d\ufffd>a&\u001d\u07de\ufffd7\ufffd\ufffd\u0019^\u0480\ufffd\u0017\u0000t\ufffd\u0015\ufffd+\ufffd}F\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdzz\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000", "tls_ja3": "9c0ebf3a1c43cd475c2d383c5063cd3a", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 8852, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\u04de\ufffd&\ufffd\r\ufffd^\ufffd\/i\ufffd.\ufffd4X\ufffd\ufffdx{jB%>6\ufffdd\ufffd< \u0210d\ufffd>a&\u07de\ufffd7\ufffd\ufffd^\u0480\ufffdt\ufffd\ufffd+\ufffd}F\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdzz\ufffd", "attack_vector": "tls probe \u00b7 via TLS:8852 \u00b7 (sonde \/ probe)", "target_port_label": "8852 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8852, "protocol_emulated": null, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\f\u0001\u0000\u0002\b\u0003\u0003\u04de\ufffd&\ufffd\r\ufffd^\ufffd\u0001\/\u0000i\ufffd.\ufffd4X\ufffd\ufffdx{jB%>\u00166\ufffdd\ufffd< \u0210d\ufffd>a&\u001d\u07de\ufffd7\ufffd\ufffd\u0019^\u0480\ufffd\u0017\u0000t\ufffd\u0015\ufffd+\ufffd}F\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdzz\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\n\u0000", "tls_ja3": "9c0ebf3a1c43cd475c2d383c5063cd3a", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 8852, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:8852 \u00b7 (sonde \/ probe)", "evidence_snippet": "\u04de\ufffd&\ufffd\r\ufffd^\ufffd\/i\ufffd.\ufffd4X\ufffd\ufffdx{jB%>6\ufffdd\ufffd< *\u0210d\ufffd>a&\u07de\ufffd7\ufffd\ufffd^\u0480\ufffdt\ufffd\ufffd+\ufffd}F\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdzz\ufffd", "target_port_label": "8852 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8852" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }
06/08/2026 12:25:42 UTC	TCP	8852 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:8852 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 20b279993ae2e137 SNI www.blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 Cible HTTP — TLS SNI www.blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 8852 Chemin / cible — Service TLS SNI TLS www.blacklistip.com Payload ��R+��@�O&�p{�'��d��/E$ tE�TF�w��¯�?�� ؓ�jG5�WH��H�+�/�,�0̨̩� �� {www.blackli Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��R+��@�O&�p{�'��d��/E$ tE�TF�w��¯�?�� ؓ�jG5�WH��H�+�/�,�0̨̩� �� {www.blackli Requête brute (extrait) ��R+��@�O&�p{�'��d��/E$ tE�TF�w��¯�?�� ؓ�jG5�WH��H�+�/�,�0̨̩� �� {www.blacklistip.com � � 2+ 3�� Meta JSON brut { "tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "www.blacklistip.com", "bytes_in": 1511, "payload_entropy": 7.72882537851668, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 8852, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "9f178c0ef11b1b3ef0df35a3e9ce11996a2b1382", "event_fingerprint": "225bb6b0595e6661bb027590242d5903c0f79a0b", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "20b279993ae2e137e62b9647c6d768fb", "payload_hash": "a258efec4bb3d974757976048bc90e7b", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "tls_sni": "www.blacklistip.com" }, "target_context": { "dst_port": 8852, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdR+\ufffd\u0012\ufffd@\ufffdO&\ufffdp\u0000{\ufffd'\ufffd\ufffd\u0007\ufffdd\ufffd\ufffd\u0092\ufffd\/E$ tE\ufffdTF\ufffdw\ufffd\ufffd\ufffd\u00af\ufffd?\ufffd\ufffd\n\u001f\u0000\u0613\ufffdjG5\ufffdWH\ufffd\ufffdH\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdR+\ufffd\u0012\ufffd@\ufffdO&\ufffdp\u0000{\ufffd'\ufffd\ufffd\u0007\ufffdd\ufffd\ufffd\u0092\ufffd\/E$ tE\ufffdTF\ufffdw\ufffd\ufffd\ufffd\u00af\ufffd?\ufffd\ufffd\n\u001f\u0000\u0613\ufffdjG5\ufffdWH\ufffd\ufffdH\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blacklistip.com\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdR+\ufffd\u0012\ufffd@\ufffdO&\ufffdp\u0000{\ufffd'\ufffd\ufffd\u0007\ufffdd\ufffd\ufffd\u0092\ufffd\/E$ tE\ufffdTF\ufffdw\ufffd\ufffd\ufffd\u00af\ufffd?\ufffd\ufffd\n\u001f\u0000\u0613\ufffdjG5\ufffdWH\ufffd\ufffdH\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3bfc7d7ca8b63213697e35cdc4a1bd7d310dec94", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdR+\ufffd\u0012\ufffd@\ufffdO&\ufffdp\u0000{\ufffd'\ufffd\ufffd\u0007\ufffdd\ufffd\ufffd\u0092\ufffd\/E$ tE\ufffdTF\ufffdw\ufffd\ufffd\ufffd\u00af\ufffd?\ufffd\ufffd\n\u001f\u0000\u0613\ufffdjG5\ufffdWH\ufffd\ufffdH\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "www.blacklistip.com", "port": 8852, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdR+\ufffd\ufffd@\ufffdO&\ufffdp{\ufffd'\ufffd\ufffd\ufffdd\ufffd\ufffd\u0092\ufffd\/E$ tE\ufffdTF\ufffdw\ufffd\ufffd\ufffd\u00af\ufffd?\ufffd\ufffd\n\u0613\ufffdjG5\ufffdWH\ufffd\ufffdH\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd{www.blackli", "attack_vector": "postgres probe \u00b7 via TLS:8852 \u00b7 (sonde \/ probe)", "target_port_label": "8852 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8852, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003\ufffd\ufffdR+\ufffd\u0012\ufffd@\ufffdO&\ufffdp\u0000{\ufffd'\ufffd\ufffd\u0007\ufffdd\ufffd\ufffd\u0092\ufffd\/E$ tE\ufffdTF\ufffdw\ufffd\ufffd\ufffd\u00af\ufffd?\ufffd\ufffd\n\u001f\u0000\u0613\ufffdjG5\ufffdWH\ufffd\ufffdH\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005{\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blackli", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "www.blacklistip.com", "port": 8852, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:8852 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdR+\ufffd\ufffd@\ufffdO&\ufffdp{\ufffd'\ufffd\ufffd\ufffdd\ufffd\ufffd\u0092\ufffd\/E$ tE\ufffdTF\ufffdw\ufffd\ufffd\ufffd\u00af\ufffd?\ufffd\ufffd\n\u0613\ufffdjG5\ufffdWH\ufffd\ufffdH\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd{www.blackli", "target_port_label": "8852 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8852" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3" ] }
06/08/2026 11:52:57 UTC	TCP	8251 · TLS	tls	Sonde TLS tls probe · via TLS:8251 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 7012bcfb2b0920ab SNI www.blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI www.blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 8251 Chemin / cible — Service TLS SNI TLS www.blacklistip.com Payload 62��߮N��(wIn2%S3��]i�A �FGc9!�%��膧�ܡ%�Y,a�i�� +�/�,�0̨̩��/5�JJDih2 Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0771 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) 62��߮N��(wIn2%S3��]i�A �FGc9!�%��膧�ܡ%�Y,a�i�� +�/�,�0̨̩��/5�JJDih2 Requête brute (extrait) 62��߮N��(wIn2%S3��]i�A �FGc9!�%��膧�ܡ%�Y,a�i�� +�/�,�0̨̩��/5�JJDih2�www.blacklistip.com+ � �� m[�'��r�m�EY1^�䷂��T�aН�g�D$��?u�}�s�G��H����}� Meta JSON brut { "tls_ja3_hash": "7012bcfb2b0920ab2103357b24822ce5", "tls_sni": "www.blacklistip.com", "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 571, "payload_entropy": 6.924622605338042, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 8251, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.5, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 2, "anomaly_count": 0, "campaign_key": "c506047fd69c82c68a20037ea0ecee7ba28958d3", "event_fingerprint": "8c18a342e9570941ee3e5ea6c3255c43872df895", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0771" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "7012bcfb2b0920ab2103357b24822ce5", "payload_hash": "bd317160b9603f4d1c7f54a133dbd799", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "www.blacklistip.com" }, "target_context": { "dst_port": 8251, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0016\u07ee\u0006N\ufffd\u0018\u0014\ufffd\ufffd\ufffd(wIn2%S3\ufffd\ufffd\ufffd]i\ufffd\u0001A \ufffdFGc9!\ufffd\u0017%\u0001\ufffd\ufffd\u81a7\ufffd\u0721%\ufffdY\u0010,a\ufffd\u0005\u0017\u001fi\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdJJ\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0016\u07ee\u0006N\ufffd\u0018\u0014\ufffd\ufffd\ufffd(wIn2%S3\ufffd\ufffd\ufffd]i\ufffd\u0001A \ufffdFGc9!\ufffd\u0017%\u0001\ufffd\ufffd\u81a7\ufffd\u0721%\ufffdY\u0010,a\ufffd\u0005\u0017\u001fi\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdJJ\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000\u0000\u0000\u0018\u0000\u0016\u0000\u0000\u0013www.blacklistip.com\u0000+\u0000\u0007\u0006\n\n\u0003\u0004\u0003\u0003\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 m[\ufffd'\ufffd\u0004\ufffdr\ufffdm\ufffdEY1^\ufffd\u4dc2\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001dT\ufffda\u0000\u041d\ufffdg\ufffd\u0003D$\ufffd\ufffd?u\ufffd}\ufffds\ufffdG\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffd\ufffd\u001f\u001c\ufffd}\ufffd", "payload_snippet": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0016\u07ee\u0006N\ufffd\u0018\u0014\ufffd\ufffd\ufffd(wIn2%S3\ufffd\ufffd\ufffd]i\ufffd\u0001A \ufffdFGc9!\ufffd\u0017%\u0001\ufffd\ufffd\u81a7\ufffd\u0721%\ufffdY\u0010,a\ufffd\u0005\u0017\u001fi\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdJJ\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "639869f7adea9c63ebb24d753dea76ad88a7c326", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0016\u07ee\u0006N\ufffd\u0018\u0014\ufffd\ufffd\ufffd(wIn2%S3\ufffd\ufffd\ufffd]i\ufffd\u0001A \ufffdFGc9!\ufffd\u0017%\u0001\ufffd\ufffd\u81a7\ufffd\u0721%\ufffdY\u0010,a\ufffd\u0005\u0017\u001fi\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdJJ\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000", "tls_ja3": "7012bcfb2b0920ab2103357b24822ce5", "tls_sni": "www.blacklistip.com", "port": 8251, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "62\ufffd\ufffd\ufffd\ufffd\u07eeN\ufffd\ufffd\ufffd\ufffd(wIn2%S3\ufffd\ufffd\ufffd]i\ufffdA \ufffdFGc9!\ufffd%\ufffd\ufffd\u81a7\ufffd\u0721%\ufffdY,a\ufffdi\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdJJDih2", "attack_vector": "tls probe \u00b7 via TLS:8251 \u00b7 (sonde \/ probe)", "target_port_label": "8251 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8251, "protocol_emulated": null, "tags_summary": [ "pat-0771" ], "tags_summary_labels_fr": [ "pat-0771" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u00026\u0001\u0000\u00022\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0016\u07ee\u0006N\ufffd\u0018\u0014\ufffd\ufffd\ufffd(wIn2%S3\ufffd\ufffd\ufffd]i\ufffd\u0001A \ufffdFGc9!\ufffd\u0017%\u0001\ufffd\ufffd\u81a7\ufffd\u0721%\ufffdY\u0010,a\ufffd\u0005\u0017\u001fi\ufffd\ufffd\u0000 \ufffd\ufffd\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffdJJ\u0000\u0000Di\u0000\u0005\u0000\u0003\u0002h2\u0000", "tls_ja3": "7012bcfb2b0920ab2103357b24822ce5", "tls_sni": "www.blacklistip.com", "port": 8251, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:8251 \u00b7 (sonde \/ probe)", "evidence_snippet": "62\ufffd\ufffd\ufffd\ufffd\u07eeN\ufffd\ufffd\ufffd\ufffd(wIn2%S3\ufffd\ufffd\ufffd]i\ufffdA \ufffdFGc9!\ufffd%\ufffd\ufffd\u81a7\ufffd\u0721%\ufffdY,a\ufffdi\ufffd\ufffd \ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\ufffdJJDih2", "target_port_label": "8251 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8251" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }
06/08/2026 11:52:56 UTC	TCP	8251 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:8251 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 fb60ce4e775fabbb Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8251 Chemin / cible — Service TLS Payload ��Y#J�@�a�N��m^N�yCP�� ڴd7��te ��ʔ,ȭx��ń�ɐ�P jj�+�/�,�0̨̩��/5m�� Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��Y#J�@�a�N��m^N�yCP�� ڴd7��te ��ʔ,ȭx��ń�ɐ�P jj�+�/�,�0̨̩��/5m�� Requête brute (extrait) ��Y#J�@�a�N��m^N�yCP�� ڴd7��te ��ʔ,ȭx��ń�ɐ�P jj�+�/�,�0̨̩��/5m�� _�\|Z\p��Hf5��́,�TGmh��+�h�a]r+C��9�N�ӯ�稣[mf��p9��d8�W�3�ƺS�%�UR��=V0��9!{�+ � Meta JSON brut { "tls_ja3_hash": "fb60ce4e775fabbb3ed7f2c475b3abfb", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 479, "payload_entropy": 6.796220745942962, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 8251, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 1.8, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "c1e4495d1d7d206cfafc7319cbc753a20669b155", "event_fingerprint": "e51f04358c6572cde5c81292b69fd435fd1f6474", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "fb60ce4e775fabbb3ed7f2c475b3abfb", "payload_hash": "8ee52774910d4f9aa92da333a00d800c", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5" }, "target_context": { "dst_port": 8251, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0016\ufffd\ufffdY#J\ufffd@\uf1e6\u0018\ufffda\ufffdN\ufffd\ufffd\u0007m^N\u0012\u001b\ufffdyCP\ufffd\ufffd\u000e\ufffd \ufffd\u06b4d7\ufffd\ufffd\ufffdte\t\u001f\ufffd\ufffd\u0294,\u022d\u001dx\ufffd\ufffd\ufffd\ufffd\u0144\ufffd\u0250\ufffdP\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m\ufffd\ufffd\u0000\u0000\u0000\n\u0000\n\u0000\b\n\n\u0000", "evidence": { "request_sample": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0016\ufffd\ufffdY#J\ufffd@\uf1e6\u0018\ufffda\ufffdN\ufffd\ufffd\u0007m^N\u0012\u001b\ufffdyCP\ufffd\ufffd\u000e\ufffd \ufffd\u06b4d7\ufffd\ufffd\ufffdte\t\u001f\ufffd\ufffd\u0294,\u022d\u001dx\ufffd\ufffd\ufffd\ufffd\u0144\ufffd\u0250\ufffdP\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m\ufffd\ufffd\u0000\u0000\u0000\n\u0000\n\u0000\b\n\n\u0000\u001d\u0000\u0017\u0000\u0018\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001\ufffd\u0000 \ufffd\ufffd\u0006_\ufffd\|Z\\p\ufffd\u0011\ufffdHf\u001b5\ufffd\ufffd\u0301,\ufffdTGmh\ufffd\ufffd+\ufffdh\u0000\ufffda]r+C\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0019\ufffd9\ufffdN\ufffd\u04ef\ufffd\u7a23[mf\ufffd\ufffd\ufffdp9\ufffd\ufffd\ufffdd8\ufffdW\ufffd3\ufffd\u01baS\ufffd%\u001b\ufffdUR\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd=V0\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd9!{\ufffd+\u001e\f\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0016\ufffd\ufffdY#J\ufffd@\uf1e6\u0018\ufffda\ufffdN\ufffd\ufffd\u0007m^N\u0012\u001b\ufffdyCP\ufffd\ufffd\u000e\ufffd \ufffd\u06b4d7\ufffd\ufffd\ufffdte\t\u001f\ufffd\ufffd\u0294,\u022d\u001dx\ufffd\ufffd\ufffd\ufffd\u0144\ufffd\u0250\ufffdP\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m\ufffd\ufffd\u0000\u0000\u0000\n\u0000\n\u0000\b\n\n\u0000", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "16483ad232ff418f9cb95221e1d802c034a3950a", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0016\ufffd\ufffdY#J\ufffd@\uf1e6\u0018\ufffda\ufffdN\ufffd\ufffd\u0007m^N\u0012\u001b\ufffdyCP\ufffd\ufffd\u000e\ufffd \ufffd\u06b4d7\ufffd\ufffd\ufffdte\t\u001f\ufffd\ufffd\u0294,\u022d\u001dx\ufffd\ufffd\ufffd\ufffd\u0144\ufffd\u0250\ufffdP\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m\ufffd\ufffd\u0000\u0000\u0000\n\u0000\n\u0000\b\n\n\u0000", "tls_ja3": "fb60ce4e775fabbb3ed7f2c475b3abfb", "port": 8251, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdY#J\ufffd@\uf1e6\ufffda\ufffdN\ufffd\ufffdm^N\ufffdyCP\ufffd\ufffd\ufffd \ufffd\u06b4d7\ufffd\ufffd\ufffdte\t\ufffd\ufffd\u0294,\u022dx\ufffd\ufffd\ufffd\ufffd\u0144\ufffd\u0250\ufffdP jj\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5m\ufffd\ufffd", "attack_vector": "postgres probe \u00b7 via TLS:8251 \u00b7 (sonde \/ probe)", "target_port_label": "8251 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8251, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0003\u0003\u0016\ufffd\ufffdY#J\ufffd@\uf1e6\u0018\ufffda\ufffdN\ufffd\ufffd\u0007m^N\u0012\u001b\ufffdyCP\ufffd\ufffd\u000e\ufffd \ufffd\u06b4d7\ufffd\ufffd\ufffdte\t\u001f\ufffd\ufffd\u0294,\u022d\u001dx\ufffd\ufffd\ufffd\ufffd\u0144\ufffd\u0250\ufffdP\u0000 jj\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001m\ufffd\ufffd\u0000\u0000\u0000\n\u0000\n\u0000\b\n\n\u0000", "tls_ja3": "fb60ce4e775fabbb3ed7f2c475b3abfb", "port": 8251, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:8251 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdY#J\ufffd@\uf1e6\ufffda\ufffdN\ufffd\ufffdm^N\ufffdyCP\ufffd\ufffd\ufffd \ufffd\u06b4d7\ufffd\ufffd\ufffdte\t\ufffd\ufffd\u0294,\u022dx\ufffd\ufffd\ufffd\ufffd\u0144\ufffd\u0250\ufffdP jj\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5m\ufffd\ufffd", "target_port_label": "8251 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8251" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
06/08/2026 11:29:21 UTC	TCP	6496 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:6496 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 20b279993ae2e137 SNI ip-62-3-50-33.v4.isp.servpersosystems.net Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 Cible HTTP — TLS SNI ip-62-3-50-33.v4.isp.servpersosystems.net Capteur paris-1
Preuve / Evidence Méthode — Port 6496 Chemin / cible — Service TLS SNI TLS ip-62-3-50-33.v4.isp.servpersosystems.net Payload ��K��V��Z9B� �󦞣�{k�S ��t�� k 1Y eNzQ?�cB��V��v�a^��+�/�,�0̨̩� �� .,)ip-62-3-50- Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��K��V��Z9B� �󦞣�{k�S ��t�� k 1YeNzQ?�cB��V��v�a^��+�/�,�0̨̩� �� .,)ip-62-3-50- Requête brute (extrait) ��K��V��Z9B� �󦞣�{k�S ��t�� k 1Y eNzQ?�cB��V��v�a^��+�/�,�0̨̩� �� .,)ip-62-3-50-33.v4.isp.servpersosystems.net � � 2 Meta JSON brut { "tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "bytes_in": 1533, "payload_entropy": 7.722105118695942, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 6496, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "5935821f80d8b59d41594f33de4c84b7dd261f0f", "event_fingerprint": "a86433e9c81b8f6cb1b91e5a8162f5d5670f5280", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "20b279993ae2e137e62b9647c6d768fb", "payload_hash": "097cd6a634628a5e931c3a9e68508494", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net" }, "target_context": { "dst_port": 6496, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003K\ufffd\ufffd\u0002V\ufffd\u001e\ufffd\ufffdZ9B\ufffd\n\ufffd\udb59\udfa3\ufffd{k\ufffd\u0018S \ufffd\ufffdt\u001c\ufffd\ufffd k\r1Y\u000b\u0019eNzQ?\ufffdcB\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdv\ufffda^\ufffd\ufffd\u001c\u0017\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003K\ufffd\ufffd\u0002V\ufffd\u001e\ufffd\ufffdZ9B\ufffd\n\ufffd\udb59\udfa3\ufffd{k\ufffd\u0018S \ufffd\ufffdt\u001c\ufffd\ufffd k\r1Y\u000b\u0019eNzQ?\ufffdcB\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdv\ufffda^\ufffd\ufffd\u001c\u0017\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-33.v4.isp.servpersosystems.net\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003K\ufffd\ufffd\u0002V\ufffd\u001e\ufffd\ufffdZ9B\ufffd\n\ufffd\udb59\udfa3\ufffd{k\ufffd\u0018S \ufffd\ufffdt\u001c\ufffd\ufffd k\r1Y\u000b\u0019eNzQ?\ufffdcB\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdv\ufffda^\ufffd\ufffd\u001c\u0017\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "887948102a8a084c29bdd40e64aeaaba6ab86711", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003K\ufffd\ufffd\u0002V\ufffd\u001e\ufffd\ufffdZ9B\ufffd\n\ufffd\udb59\udfa3\ufffd{k\ufffd\u0018S \ufffd\ufffdt\u001c\ufffd\ufffd k\r1Y\u000b\u0019eNzQ?\ufffdcB\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdv\ufffda^\ufffd\ufffd\u001c\u0017\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 6496, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffdK\ufffd\ufffdV\ufffd\ufffd\ufffdZ9B\ufffd\n\ufffd\udb59\udfa3\ufffd{k\ufffdS \ufffd\ufffdt\ufffd\ufffd k\r1YeNzQ?\ufffdcB\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdv\ufffda^\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd.,)ip-62-3-50-", "attack_vector": "postgres probe \u00b7 via TLS:6496 \u00b7 (sonde \/ probe)", "target_port_label": "6496 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 6496, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003K\ufffd\ufffd\u0002V\ufffd\u001e\ufffd\ufffdZ9B\ufffd\n\ufffd\udb59\udfa3\ufffd{k\ufffd\u0018S \ufffd\ufffdt\u001c\ufffd\ufffd k\r1Y\u000b\u0019eNzQ?\ufffdcB\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdv\ufffda^\ufffd\ufffd\u001c\u0017\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005\ufffd\u0000\u0000\u0000.\u0000,\u0000\u0000)ip-62-3-50-", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "ip-62-3-50-33.v4.isp.servpersosystems.net", "port": 6496, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:6496 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdK\ufffd\ufffdV\ufffd\ufffd\ufffdZ9B\ufffd\n\ufffd\udb59\udfa3\ufffd{k\ufffdS \ufffd\ufffdt\ufffd\ufffd k\r1YeNzQ?\ufffdcB\ufffd\ufffd\ufffd\ufffdV\ufffd\ufffd\ufffdv\ufffda^\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd.,)ip-62-3-50-", "target_port_label": "6496 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "6496" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3" ] }
06/08/2026 10:58:57 UTC	TCP	8385	—	Sonde Kafka kafka probe · port 8385 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8385 Chemin / cible — Payload ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Requête brute (extrait) ��߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� # h2http/1.1 3&$ sH?�ߑ��`��%�ϋ5��߅�wM��-+ Meta JSON brut { "bytes_in": 501, "payload_entropy": 3.7940870380940184, "port_category": "registered", "org": "Zenlayer Inc", "service": null, "app_proto": null, "asn": 62610, "country": "US", "dst_port": 8385, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.4, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "3ca6cca12cc5bfd0b422f4c0b33368f0691f9b02", "event_fingerprint": "c81b0061cfcd8a5fbff9434e5c008c388e5804a3", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "29b5329f45e73a6677bca0caf0ca278c", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 8385, "risk_score": 32 }, "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003", "payload_snippet": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "69e8adbc09fdefc8bb01056f907edec5705a560e", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 8385 }, "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 port 8385 \u00b7 (sonde \/ probe)", "target_port_label": "8385", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 8385, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0001\ufffd\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 8385 }, "attack_vector": "kafka probe \u00b7 port 8385 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "target_port_label": "8385", "emulator_service": null, "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "8385" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
06/08/2026 10:42:36 UTC	TCP	9302	—	Sonde Kafka kafka probe · port 9302 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9302 Chemin / cible — Payload �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Requête brute (extrait) �߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� # h2http/1.1 3&$ sH?�ߑ��`��%�ϋ5��߅�wM��-+ Meta JSON brut { "bytes_in": 520, "payload_entropy": 3.999375592941219, "port_category": "registered", "org": "Zenlayer Inc", "service": null, "app_proto": null, "asn": 62610, "country": "US", "dst_port": 9302, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 0.3, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "a890cb7787e591ebca8599b4905df8ea83ab64c0", "event_fingerprint": "7a2c4fd2ec1d3e40c57911329502a5a09262b62c", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "3406a76f136d489bc5c37b989c06ec84", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 9302, "risk_score": 32 }, "payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003", "payload_snippet": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5994e66414cdafbd87d18521ca4a5bfb62224e9d", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 9302 }, "evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 port 9302 \u00b7 (sonde \/ probe)", "target_port_label": "9302", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 9302, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0002\u0003\u0001\u0000\u0001\ufffd\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 9302 }, "attack_vector": "kafka probe \u00b7 port 9302 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "target_port_label": "9302", "emulator_service": null, "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "9302" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
06/08/2026 10:34:54 UTC	TCP	8810	—	Sonde Kafka kafka probe · port 8810 · (sonde / probe)	Faible	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8810 Chemin / cible — Payload ߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 47% Confiance modérée — signal unique Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� Requête brute (extrait) ߳��N�+=L��ڠ�ӭ��ɓ% 5�OETѝ \|Ufj�](S�)f�< R%��'_"̨̩�+�/�,�0��S��/5�� # h2http/1.1 3&$ sH?�ߑ��`��%�ϋ5��߅�wM��-+ Meta JSON brut { "bytes_in": 542, "payload_entropy": 4.161650730260368, "port_category": "registered", "org": "Zenlayer Inc", "service": null, "app_proto": null, "asn": 62610, "country": "US", "dst_port": 8810, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 32, "tag_count": 0, "anomaly_count": 0, "campaign_key": "d2329771023701dad97857c5766a92c671d0266d", "event_fingerprint": "36122160427162dddd02cf2b97fa2ed424fa9baa", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.47, "classification_confidence": 0.47, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "named_classification_skipped": false, "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4509eec7340acca41e94bc6bae32c197", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13" }, "target_context": { "dst_port": 8810, "risk_score": 32 }, "payload_snippet": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "evidence": { "request_sample": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u000b\u0000\u0002\u0001\u0000\u0000#\u0000\u0000\u0000\u0010\u0000\u000e\u0000\f\u0002h2\bhttp\/1.1\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000\u0012\u0000\u0000\u00003\u0000&\u0000$\u0000\u001d\u0000 \u0010sH\u0004?\ufffd\u07d1\ufffd\ufffd`\ufffd\ufffd%\ufffd\u03cb\u00065\ufffd\ufffd\u07c5\ufffdwM\ufffd\ufffd\u0014\u001d\u0000-\u0000\u0002\u0001\u0001\u0000+\u0000\t\b\u0003\u0004\u0003", "payload_snippet": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2477b12123daf001f84f4d4d886520fdb61f3322", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 8810 }, "evidence_snippet": "\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 port 8810 \u00b7 (sonde \/ probe)", "target_port_label": "8810", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 47, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 32 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": null, "service_label_fr": null, "dst_port": 8810, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0001\u0001\u0002\u0019\u0001\u0000\u0002\u0015\u0001\u0001\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=\u0010L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u001d\u0253% 5\ufffdOET\u0000\u045d\u0018\r\|Ufj\ufffd]\u0015(S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\u0002\u0000\"\u0013\u0003\u0013\u0001\u0013\u0002\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\u0013\ufffd\u0014\ufffd\u0013\ufffdS\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\ufffd\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\n\u0000", "port": 8810 }, "attack_vector": "kafka probe \u00b7 port 8810 \u00b7 (sonde \/ probe)", "evidence_snippet": "\u07f3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdN\ufffd+=L\ufffd\ufffd\ufffd\u06a0\ufffd\u04ed\ufffd\ufffd\u0253% 5\ufffdOET\u045d\r\|Ufj\ufffd](S\ufffd)f\ufffd<\rR%\ufffd\ufffd'_\"\u0329\u0328\ufffd+\ufffd\/\ufffd,\ufffd0\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd\/5\ufffd\ufffd", "target_port_label": "8810", "emulator_service": null, "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 47 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "8810" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor" }
06/08/2026 09:36:42 UTC	TCP	8887 · TLS	tls	Sonde PostgreSQL postgres probe · via TLS:8887 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 20b279993ae2e137 SNI blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 Cible HTTP — TLS SNI blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 8887 Chemin / cible — Service TLS SNI TLS blacklistip.com Payload ��`�s�FY��=Эy�z��w�� %�<#�� T�Y3\| �h��q�D�2#d��3 ��+�/�,�0̨̩� �� wblacklistip Pourquoi cette classification : Type « postgres_probe » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé Signaux pat-0369 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) PostgreSQL startup Kafka ApiVersions key STUN binding Minecraft varint handshake SOCKS5 greeting SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) ��`�s�FY��=Эy�z��w�� %�<#�� T�Y3\| �h��q�D�2#d��3��+�/�,�0̨̩� �� wblacklistip Requête brute (extrait) ��`�s�FY��=Эy�z��w�� %�<#�� T�Y3\| �h��q�D�2#d��3 ��+�/�,�0̨̩� �� wblacklistip.com � � 2+ 3�� Meta JSON brut { "tls_ja3_hash": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "blacklistip.com", "bytes_in": 1507, "payload_entropy": 7.700250524250067, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 8887, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 3.7, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "6b6bfa97410ec4e5c941cf84df7332d20a28a329", "event_fingerprint": "c708bdf60ed1e61ce833993dd66744ef531c8c61", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "confidence": 0.49, "classification_confidence": 0.49, "precision_score": 58, "precision_signals": [ "pat-0369" ], "kb_rule_ids": [ "pat-0369" ], "matched_patterns": [ "pat-0369", "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "PostgreSQL startup", "Kafka ApiVersions key", "STUN binding", "Minecraft varint handshake", "SOCKS5 greeting", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0369", "pat-0556", "pat-0771", "pat-0554", "pat-0567", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 49, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "20b279993ae2e137e62b9647c6d768fb", "payload_hash": "1f126d08e7d72d0c249bb2bb51b1c998", "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5", "tls_sni": "blacklistip.com" }, "target_context": { "dst_port": 8887, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003`\ufffds\ufffdFY\ufffd\ufffd=\u042dy\ufffdz\ufffd\ufffd\ufffd\u000fw\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd%\ufffd<#\ufffd\ufffd T\ufffd\u0013Y3\|\n\ufffd\u000eh\ufffd\ufffd\u0005\ufffd\ufffdq\ufffdD\ufffd2\u000f#\u0015d\ufffd\ufffd\u001d3\f\ufffd\u0014\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip", "evidence": { "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003`\ufffds\ufffdFY\ufffd\ufffd=\u042dy\ufffdz\ufffd\ufffd\ufffd\u000fw\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd%\ufffd<#\ufffd\ufffd T\ufffd\u0013Y3\|\n\ufffd\u000eh\ufffd\ufffd\u0005\ufffd\ufffdq\ufffdD\ufffd2\u000f#\u0015d\ufffd\ufffd\u001d3\f\ufffd\u0014\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip.com\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u0016\u0000\u0014\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003`\ufffds\ufffdFY\ufffd\ufffd=\u042dy\ufffdz\ufffd\ufffd\ufffd\u000fw\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd%\ufffd<#\ufffd\ufffd T\ufffd\u0013Y3\|\n\ufffd\u000eh\ufffd\ufffd\u0005\ufffd\ufffdq\ufffdD\ufffd2\u000f#\u0015d\ufffd\ufffd\u001d3\f\ufffd\u0014\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip", "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3c5420a0f024c19a07d9ddc196223be6d5f309e7", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003`\ufffds\ufffdFY\ufffd\ufffd=\u042dy\ufffdz\ufffd\ufffd\ufffd\u000fw\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd%\ufffd<#\ufffd\ufffd T\ufffd\u0013Y3\|\n\ufffd\u000eh\ufffd\ufffd\u0005\ufffd\ufffdq\ufffdD\ufffd2\u000f#\u0015d\ufffd\ufffd\u001d3\f\ufffd\u0014\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "blacklistip.com", "port": 8887, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd`\ufffds\ufffdFY\ufffd\ufffd=\u042dy\ufffdz\ufffd\ufffd\ufffdw\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd%\ufffd<#\ufffd\ufffd T\ufffdY3\|\n\ufffdh\ufffd\ufffd\ufffd\ufffdq\ufffdD\ufffd2#d\ufffd\ufffd3\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdwblacklistip", "attack_vector": "postgres probe \u00b7 via TLS:8887 \u00b7 (sonde \/ probe)", "target_port_label": "8887 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 49, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 8887, "protocol_emulated": null, "tags_summary": [ "pat-0369" ], "tags_summary_labels_fr": [ "pat-0369" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003`\ufffds\ufffdFY\ufffd\ufffd=\u042dy\ufffdz\ufffd\ufffd\ufffd\u000fw\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd%\ufffd<#\ufffd\ufffd T\ufffd\u0013Y3\|\n\ufffd\u000eh\ufffd\ufffd\u0005\ufffd\ufffdq\ufffdD\ufffd2\u000f#\u0015d\ufffd\ufffd\u001d3\f\ufffd\u0014\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005w\u0000\u0000\u0000\u0014\u0000\u0012\u0000\u0000\u000fblacklistip", "tls_ja3": "20b279993ae2e137e62b9647c6d768fb", "tls_sni": "blacklistip.com", "port": 8887, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "postgres probe \u00b7 via TLS:8887 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd`\ufffds\ufffdFY\ufffd\ufffd=\u042dy\ufffdz\ufffd\ufffd\ufffdw\ufffd\ufffd\t\ufffd\ufffd\ufffd\ufffd%\ufffd<#\ufffd\ufffd T\ufffdY3\|\n\ufffdh\ufffd\ufffd\ufffd\ufffdq\ufffdD\ufffd2#d\ufffd\ufffd3\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdwblacklistip", "target_port_label": "8887 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "8887" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3" ] }
06/08/2026 08:40:50 UTC	TCP	7776 · TLS	tls	Sonde Kafka kafka probe · via TLS:7776 · (sonde / probe)	Élevée	Faible · 32
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole JA3 90c839a85a368ff2 SNI blacklistip.com Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_weak_cipher Cible HTTP — TLS SNI blacklistip.com Capteur paris-1
Preuve / Evidence Méthode — Port 7776 Chemin / cible — Service TLS SNI TLS blacklistip.com Payload 2.�$�ݎ�S�W�S��<�m3SLq��LT� ?N�k�o��1�LF�L�R��B[�� +�/�,�0̨̩��/5Ū�+�� Pourquoi cette classification : Type « kafka_probe » (signaux protocolaires) · confiance 47% Confiance classification 55% Corrélation +8 Risque capteur Faible · 32 Confiance : Confiance 47 % — Motif catalogue confirmé Signaux pat-0556 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) Kafka ApiVersions key Sybase TDS login STUN binding Minecraft varint handshake SIP TLS ClientHello TFTP RRQ User-Agent — Règles WAF — Payload (extrait) 2.�$�ݎ�S�W�S��<�m3SLq��LT� ?N�k�o��1�LF�L�R��B[�� +�/�,�0̨̩��/5Ū�+�� Requête brute (extrait) 2.�$�ݎ�S�W�S��<�m3SLq��LT� ?N�k�o��1�LF�L�R��B[�� +�/�,�0̨̩��/5Ū�+�� jj #� �> ��u[��(�XO�P,�� -�xg�@ATd�@T��V Meta JSON brut { "tls_ja3_hash": "90c839a85a368ff2a0307977d5346dfe", "tls_sni": "blacklistip.com", "tls_weak_cipher": true, "tls_weak_cipher_count": 2, "tls_alpn": [ "h2", "http\/1.1" ], "bytes_in": 567, "payload_entropy": 6.968697949708957, "port_category": "registered", "org": "Zenlayer Inc", "service": "tls", "app_proto": "tls", "asn": 62610, "country": "US", "dst_port": 7776, "risk_waf": 8, "risk_classification": 56, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 32, "tag_count": 2, "anomaly_count": 0, "campaign_key": "795f520791427132d72e655444dffc0db53a3488", "event_fingerprint": "2e8b3cf347290afdb07bc85bd49c1982e01cd57f", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "confidence": 0.55, "classification_confidence": 0.55, "precision_score": 56, "precision_signals": [ "pat-0556" ], "kb_rule_ids": [ "pat-0556" ], "matched_patterns": [ "pat-0556", "pat-0607", "pat-0771", "pat-0554", "pat-0578", "pat-0536" ], "matched_pattern_names": [ "Kafka ApiVersions key", "Sybase TDS login", "STUN binding", "Minecraft varint handshake", "SIP TLS ClientHello", "TFTP RRQ" ], "pattern_ids": [ "pat-0556", "pat-0607", "pat-0771", "pat-0554", "pat-0578", "pat-0536" ], "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 32, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "tls", "risk_confidence_factor": 47, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "US", "asn": 62610, "org": "Zenlayer Inc", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "90c839a85a368ff2a0307977d5346dfe", "payload_hash": "cfee08210f366b4de8f54bffd722b8af", "path_pattern_hash": "369bfdf011acc5969bcb68a7ffd2ca13", "tls_sni": "blacklistip.com" }, "target_context": { "dst_port": 7776, "service": "tls", "service_name": "tls", "risk_score": 32 }, "payload_snippet": "\u0016\u0003\u0001\u00022\u0001\u0000\u0002.\u0003\u0003\ufffd$\ufffd\u074e\ufffdS\ufffd\u0015\u001aW\ufffdS\ufffd\ufffd\ufffd<\ufffdm3SLq\ufffd\ufffd\u0003L\u001e\u001fT\ufffd ?\u0013\u0019N\ufffd\u0005k\ufffdo\ufffd\ufffd\u00011\ufffdLF\ufffdL\u001e\ufffdR\ufffd\ufffd\ufffdB\u000f[\ufffd\u001b\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u016a\ufffd\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003", "evidence": { "request_sample": "\u0016\u0003\u0001\u00022\u0001\u0000\u0002.\u0003\u0003\ufffd$\ufffd\u074e\ufffdS\ufffd\u0015\u001aW\ufffdS\ufffd\ufffd\ufffd<\ufffdm3SLq\ufffd\ufffd\u0003L\u001e\u001fT\ufffd ?\u0013\u0019N\ufffd\u0005k\ufffdo\ufffd\ufffd\u00011\ufffdLF\ufffdL\u001e\ufffdR\ufffd\ufffd\ufffdB\u000f[\ufffd\u001b\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u016a\ufffd\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003\u0003\u0000\u0017\u0000\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u000b\u0000\u0002\u0001\u0000\u0000\n\u0000\n\u0000\bjj\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u001b\u0000\u0003\u0002\u0000\u0002\u0000\u0012\u0000\u0000\u0000\r\u0000\u0012\u0000\u0010\u0004\u0003\b\u0004\u0004\u0001\u0005\u0003\b\u0005\u0005\u0001\b\u0006\u0006\u0001\u0000#\u0000\u0000\ufffd\r\u0000\ufffd\u0000\u0000\u0001\u0000\u0001>\u0000 \ufffd\u0015\ufffd\ufffd\ufffdu[\ufffd\ufffd\ufffd(\ufffdX\u0005O\ufffdP,\ufffd\ufffd\ufffd\ufffd\ufffd\u0002\n\ufffd\u0015\ufffd\ufffd\ufffd\ufffd-\u0000\ufffdxg\ufffd@ATd\ufffd@T\ufffd\ufffd\ufffdV", "payload_snippet": "\u0016\u0003\u0001\u00022\u0001\u0000\u0002.\u0003\u0003\ufffd$\ufffd\u074e\ufffdS\ufffd\u0015\u001aW\ufffdS\ufffd\ufffd\ufffd<\ufffdm3SLq\ufffd\ufffd\u0003L\u001e\u001fT\ufffd ?\u0013\u0019N\ufffd\u0005k\ufffdo\ufffd\ufffd\u00011\ufffdLF\ufffdL\u001e\ufffdR\ufffd\ufffd\ufffdB\u000f[\ufffd\u001b\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u016a\ufffd\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003", "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e354ef1e826500dcc91e7b9c7b521fda870b26f7", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u00022\u0001\u0000\u0002.\u0003\u0003\ufffd$\ufffd\u074e\ufffdS\ufffd\u0015\u001aW\ufffdS\ufffd\ufffd\ufffd<\ufffdm3SLq\ufffd\ufffd\u0003L\u001e\u001fT\ufffd ?\u0013\u0019N\ufffd\u0005k\ufffdo\ufffd\ufffd\u00011\ufffdLF\ufffdL\u001e\ufffdR\ufffd\ufffd\ufffdB\u000f[\ufffd\u001b\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u016a\ufffd\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003", "tls_ja3": "90c839a85a368ff2a0307977d5346dfe", "tls_sni": "blacklistip.com", "port": 7776, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "2.\ufffd$\ufffd\u074e\ufffdS\ufffdW\ufffdS\ufffd\ufffd\ufffd<\ufffdm3SLq\ufffd\ufffdLT\ufffd ?N\ufffdk\ufffdo\ufffd\ufffd1\ufffdLF\ufffdL\ufffdR\ufffd\ufffd\ufffdB[\ufffd\ufffd\ufffd \n\n\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\u016a\ufffd+\ufffd\ufffd", "attack_vector": "kafka probe \u00b7 via TLS:7776 \u00b7 (sonde \/ probe)", "target_port_label": "7776 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "classification_reason_label_fr": "Type \u00ab kafka_probe \u00bb (signaux protocolaires) \u00b7 confiance 47%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 32\/100", "confidence_pct": 55, "confidence_breakdown": { "waf": 8, "classification": 56, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 32, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 32, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 7776, "protocol_emulated": null, "tags_summary": [ "pat-0556" ], "tags_summary_labels_fr": [ "pat-0556" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u00022\u0001\u0000\u0002.\u0003\u0003\ufffd$\ufffd\u074e\ufffdS\ufffd\u0015\u001aW\ufffdS\ufffd\ufffd\ufffd<\ufffdm3SLq\ufffd\ufffd\u0003L\u001e\u001fT\ufffd ?\u0013\u0019N\ufffd\u0005k\ufffdo\ufffd\ufffd\u00011\ufffdLF\ufffdL\u001e\ufffdR\ufffd\ufffd\ufffdB\u000f[\ufffd\u001b\ufffd\ufffd\u0000 \n\n\u0013\u0001\u0013\u0002\u0013\u0003\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\u0013\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\u0001\u0000\u0001\u016a\ufffd\u0000\u0000\u0000+\u0000\u0007\u0006\ufffd\ufffd\u0003\u0004\u0003", "tls_ja3": "90c839a85a368ff2a0307977d5346dfe", "tls_sni": "blacklistip.com", "port": 7776, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "kafka probe \u00b7 via TLS:7776 \u00b7 (sonde \/ probe)", "evidence_snippet": "2.\ufffd$\ufffd\u074e\ufffdS\ufffdW\ufffdS\ufffd\ufffd\ufffd<\ufffdm3SLq\ufffd\ufffdLT\ufffd ?N\ufffdk\ufffdo\ufffd\ufffd1\ufffdLF\ufffdL\ufffdR\ufffd\ufffd\ufffdB[\ufffd\ufffd\ufffd \n\n\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\ufffd\ufffd\ufffd\/5\u016a\ufffd+\ufffd\ufffd", "target_port_label": "7776 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 47 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "7776" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "port:12499", "tls" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_weak_cipher" ] }

66.93.173.75

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence