Fiche IP

Russie

77.91.71.43

Activité suspecte · risque 34/100

FAI Alferov Aleksey Aleksandrovich Première vue 15/10/2026 09:28 UTC Dernière vue 30/10/2026 01:04 UTC Risque Moyen

Période 2026-10-24 → 2026-10-31

Moyen 50/100

24h 7j 30j 90j

Synthèse

Score de risque max. 50/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 15/10/2026 09:28 UTC

Dernière observation 30/10/2026 01:04 UTC

Événements (période) 516

Décision conseillée Surveiller Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal TA0007 569 occurrences

Pourquoi listée

Négociation protocole RDP · confiance 0%

Confiance 0 % — 3 signal(aux) capteur

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

50/100 Confiance 0 % 516 événements TA0007

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 77.91.71.43
Décision : Investiguer
Score max : 50/100 (Moyen)
Confiance : 0 %
Période : 2026-10-24 → 2026-10-31 · 516 événements
Motif : Négociation protocole RDP · confiance 0%
MITRE : TA0007
FAI : Alferov Aleksey Aleksandrovich · Russie

Comparaison ASN / FAI

ASN 211486 · 77.91.71.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 516 événements sur la période pour cette IP.

77.91.71.92 Tentative d'exploit 22/10/2026 03:20 UTC
77.91.122.10 Sonde port 6381/TCP 18/10/2026 09:01 UTC
77.91.122.9 Sonde Redis alternatif (6380/TCP) 18/10/2026 07:58 UTC
93.152.208.38 Sonde TLS 07/08/2026 04:23 UTC
93.152.208.26 Sonde TLS 07/08/2026 04:17 UTC
93.152.208.42 Sonde TLS 06/08/2026 21:59 UTC
77.91.71.23 Sonde PostgreSQL 21/07/2026 15:52 UTC
77.91.71.91 Sonde PostgreSQL 21/07/2026 15:13 UTC

Événements (filtres)

516

Première observation

15/10/2026 09:28 UTC

Dernière observation

30/10/2026 01:04 UTC

Dernière activité (filtres)

30/10/2026 01:04 UTC

Événements 7j

516

Ports distincts (7j)

512

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

RDP TCP 7 STRATUM TCP 1 HTTP ALT 8001 TCP 1 ZIPKIN TCP 1 MARIADB TCP 1 BITCOIN TCP 1 MYSQL TCP 1 SAP GATEWAY TCP 1 SAP HANA TCP 1

RDP

STRATUM

HTTP ALT 8001

ZIPKIN

MARIADB

BITCOIN

Géolocalisation

Origine réseau déclarée

Russie unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Alferov Aleksey Aleksandrovich 0 Port 16314 Sonde RDP

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

rdp cookie · via RDP:3389 · (sonde / probe)

Détails protocole

Aperçu payload

*%�Cookie: mstshash=Test %��d�p��$� ��

Port / service

3389 · RDP

Service émulé

RDP

Raison confiance

Confiance 0 % — 3 signal(aux) capteur

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Confiance

0% Confiance non établie

Famille de menace

unknown

MITRE ATT&CK — tactiques observées

Découverte Accès initial

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

516 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

516 événement(s) — page 7/21

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
28/10/2026 08:33:38 UTC	TCP	29164	—	Sonde port 29164 Sonde port · port 29164 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 29164 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":29164,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.8,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"244c60d7584797bab6404b4db25cf031b2aa567f","event_fingerprint":"5baaa796e8880d2d8429acbfdc20a602bcc2918d","classification_confidence":0.58,"confidence":0.58,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":29164,"risk_score":44},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","request_sample":"\u0…
28/10/2026 08:32:02 UTC	TCP	26095	—	Sonde port 26095 Sonde port · port 26095 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 26095 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":26095,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.8,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"76a4a2f27dd7ed83056628da0a148cedad490bf3","event_fingerprint":"8b22825e2ef4e3bff9e2d0cc73d1ef807f8243a3","classification_confidence":0.58,"confidence":0.58,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":26095,"risk_score":44},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","request_sample":"\u0…
28/10/2026 08:30:05 UTC	TCP	4598	—	Sonde port 4598 Sonde port · port 4598 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4598 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":4598,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.6,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"373f8c44727afbe4613478e3bfba24dc22f387ee","event_fingerprint":"c6bef50efa352810e98b281d697b3947e2dd46c3","classification_confidence":0.58,"confidence":0.58,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":4598,"risk_score":44},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","request_sample":"\u000…
28/10/2026 08:28:43 UTC	TCP	26019	—	Sonde port 26019 Sonde port · port 26019 · (sonde / probe)	Faible	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 26019 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance faible (0 %) — classification prudente Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":26019,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.6,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":33,"tag_count":0,"anomaly_count":0,"campaign_key":"354643a5ab0e2a02f43345fcfe737c2b6522dc42","event_fingerprint":"b1dbfefc217cfaf8d49781ec793a60a8a7e025dc","classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":33,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":26019,"risk_score":33},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000…
28/10/2026 08:28:15 UTC	TCP	13295	—	Sonde port 13295 Sonde port · port 13295 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 13295 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":13295,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.3,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"83b8cf975c330d737fbb611408ec26ab58407266","event_fingerprint":"577ae05c38d72f7c24d0915a9180fa16ccd85aa3","classification_confidence":0.58,"confidence":0.58,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":13295,"risk_score":44},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","request_sample":"\u0…
28/10/2026 08:25:50 UTC	TCP	16461	—	Sonde port 16461 Sonde port · port 16461 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 16461 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":16461,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"148d57d3d42e42a2f17314c54c6ee803c8a7eae7","event_fingerprint":"3e089573ff6edae91afbdcb90f7e9d377686b909","classification_confidence":0.58,"confidence":0.58,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":16461,"risk_score":44},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","request_sample":"\u000…
28/10/2026 08:24:19 UTC	TCP	26758	—	Sonde port 26758 Sonde port · port 26758 · (sonde / probe)	Faible	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 26758 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance faible (0 %) — classification prudente Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":26758,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.8,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":33,"tag_count":0,"anomaly_count":0,"campaign_key":"28d58c2efadf002544277be8521cd467132966e8","event_fingerprint":"1c51aecbbdb5ef185cb50b11cf6627d7a1a1b61a","classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":33,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":26758,"risk_score":33},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000…
28/10/2026 08:23:50 UTC	TCP	4391	—	Sonde port 4391 Sonde port · port 4391 · (sonde / probe)	Faible	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4391 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance faible (0 %) — classification prudente Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":4391,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.2,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":33,"tag_count":0,"anomaly_count":0,"campaign_key":"58f712c2d3a14ccecb10d71fadeb78da83ff05ee","event_fingerprint":"d6c8520927607e11286a2f8976e8737b971bec8b","classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":33,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":4391,"risk_score":33},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u…
28/10/2026 08:23:18 UTC	TCP	15383	—	Sonde port 15383 Sonde port · port 15383 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 15383 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":15383,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.1,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"6f1efd2be8f6858adadc27e1d85df18bd609d1b5","event_fingerprint":"f2739f07f4c544b4507f02f4cb912b5b85853091","classification_confidence":0.58,"confidence":0.58,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":15383,"risk_score":44},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","request_sample":"\u0…
28/10/2026 08:22:07 UTC	TCP	32803	—	Sonde port 32803 Sonde port · port 32803 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 32803 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":32803,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.8,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"2380e6567e22b6d8ab8f40ac1e14a2938c9ec946","event_fingerprint":"1f3622b533a4ba7153e5f0b37f828bd5a9676858","classification_confidence":0.58,"confidence":0.58,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":32803,"risk_score":44},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","request_sample":"\u0…
28/10/2026 08:19:42 UTC	TCP	27406	—	Sonde port 27406 Sonde port · port 27406 · (sonde / probe)	Faible	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 27406 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance faible (0 %) — classification prudente Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":27406,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.3,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":33,"tag_count":0,"anomaly_count":0,"campaign_key":"92c39b7e41c88159f23a9cb66ecd5d9f6d671722","event_fingerprint":"6ff9b04382ae827ee9dddceda5316a04fd9286ca","classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":33,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":27406,"risk_score":33},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000…
28/10/2026 08:18:54 UTC	TCP	4439	—	Sonde port 4439 Sonde port · port 4439 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4439 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":4439,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"07cf2141dafadd24a42ce3f9c1bfbb90d9176200","event_fingerprint":"681273543d88fcaed4c35bc14f898061e63e545d","classification_confidence":0.58,"confidence":0.58,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":4439,"risk_score":44},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","request_sample":"\u0003\…
28/10/2026 08:14:44 UTC	TCP	10552	—	Scan de ports port scan syn · port 10552 · (reconnaissance)	Faible	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10552 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance élevée (100 %) — signaux convergents Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":10552,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.9,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":42,"tag_count":0,"anomaly_count":0,"campaign_key":"a9ecf3b35720653bc5278650c704139158c18c3b","event_fingerprint":"146162882cdc56a875b77d472aa24c631bbdf904","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":10552,"risk_score":42},"payload_preview":"\u…
28/10/2026 08:14:13 UTC	TCP	32867	—	Scan de ports port scan syn · port 32867 · (reconnaissance)	Faible	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 32867 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance élevée (100 %) — signaux convergents Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":32867,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":42,"tag_count":0,"anomaly_count":0,"campaign_key":"eddec32b795b71d2b316e7891f2fb7e32621f471","event_fingerprint":"c7dcf800f726656c40069285db288bc72fd8eadb","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":32867,"risk_score":42},"payload_preview":"\u…
28/10/2026 08:14:05 UTC	TCP	21610	—	Sonde port 21610 Sonde port · port 21610 · (sonde / probe)	Faible	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 21610 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance faible (0 %) — classification prudente Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":21610,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.5,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":33,"tag_count":0,"anomaly_count":0,"campaign_key":"33c6bfa3e6335bad4a925a01484051dac1b38f60","event_fingerprint":"28a50a3b01b342f511abbc6d9c01152b4782a744","classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":33,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":21610,"risk_score":33},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000…
28/10/2026 08:13:21 UTC	TCP	32859	—	Sonde port 32859 Sonde port · port 32859 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 32859 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":32859,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.8,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"06cd60d34941d783c6ec60d4e921635915937fb9","event_fingerprint":"f895c6dc62ea09ff3ca29503a51b8071a8dc40fc","classification_confidence":0.58,"confidence":0.58,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":32859,"risk_score":44},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","request_sample":"\u0…
28/10/2026 08:11:45 UTC	TCP	4618	—	Sonde port 4618 Sonde port · port 4618 · (sonde / probe)	Faible	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4618 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance faible (0 %) — classification prudente Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":4618,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.8,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":33,"tag_count":0,"anomaly_count":0,"campaign_key":"d45ba44dcc93a983030faf6933e776516523b2f0","event_fingerprint":"2605ae15b49353874792ca23088bc7d8b208ca86","classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":33,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":4618,"risk_score":33},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u…
28/10/2026 08:11:37 UTC	TCP	26682	—	Sonde port 26682 Sonde port · port 26682 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 26682 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":26682,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.5,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"e8869d1c9b6f4fd87a81178c26e3be797c938007","event_fingerprint":"2ca1da3082a9591283251fefede1c9e48db299b6","classification_confidence":0.58,"confidence":0.58,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":26682,"risk_score":44},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","request_sample":"\u0…
28/10/2026 08:08:40 UTC	TCP	29716	—	Sonde port 29716 Sonde port · port 29716 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 29716 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":29716,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.9,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"c6ab02b8b585264b9defaaa2ee0203a67ba75716","event_fingerprint":"eae429c09513d70e71a3e6d2d87d99b0993f4208","classification_confidence":0.58,"confidence":0.58,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":29716,"risk_score":44},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","request_sample":"\u0…
28/10/2026 08:05:49 UTC	TCP	26236	—	Sonde port 26236 Sonde port · port 26236 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 26236 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":26236,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.6,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"4e33fee61a52a85d9a05f365550290491b0ac01e","event_fingerprint":"7281663543b971b703480cf581168a6a63163b35","classification_confidence":0.58,"confidence":0.58,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":26236,"risk_score":44},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","request_sample":"\u0…
28/10/2026 08:04:12 UTC	TCP	23195	—	Sonde port 23195 Sonde port · port 23195 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 23195 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":23195,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.1,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"eb34c90dce914f1e0649672dda942190ce975fdd","event_fingerprint":"92c4bdb4b562c9b31d026121ad0596e8e3fe1fd0","classification_confidence":0.58,"confidence":0.58,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":23195,"risk_score":44},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","request_sample":"\u0…
28/10/2026 08:02:43 UTC	TCP	28678	—	Sonde port 28678 Sonde port · port 28678 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 28678 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Sonde port » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Payload (extrait) /�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":28678,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.5,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"b4b65828b68be5bcbbecadd92cec3a8a3af079f9","event_fingerprint":"c143e58910529fc441ecd1501df0806d69cc998f","classification_confidence":0.58,"confidence":0.58,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44,"correlation_boost":8},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":28678,"risk_score":44},"payload_preview":"\u0003\u0000\u0000\/\ufffd\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Administr\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","request_sample":"\u0…
28/10/2026 08:00:14 UTC	TCP	23263	—	Scan de ports port scan syn · port 23263 · (reconnaissance)	Faible	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 23263 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance élevée (100 %) — signaux convergents Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":23263,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":42,"tag_count":0,"anomaly_count":0,"campaign_key":"4ed62e524ebdcc1031a15d1e110caf2eb5a5b546","event_fingerprint":"e0460b4cbcd72aba662d1f337976aa7879db95ee","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":23263,"risk_score":42},"payload_preview":"\…
28/10/2026 07:59:29 UTC	TCP	16260	—	Scan de ports port scan syn · port 16260 · (reconnaissance)	Faible	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 16260 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance élevée (100 %) — signaux convergents Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":16260,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":42,"tag_count":0,"anomaly_count":0,"campaign_key":"d17c058a38a37103cf267a01302d7b21d161772f","event_fingerprint":"d4856b96f431c925974ac55332767a008cbddb02","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":16260,"risk_score":42},"payload_preview":"\…
28/10/2026 07:59:26 UTC	TCP	9576	—	Scan de ports port scan syn · port 9576 · (reconnaissance)	Faible	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 9576 Chemin / cible — Payload /�Cookie: mstshash=Administr Pourquoi cette classification :* Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance élevée (100 %) — signaux convergents Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) /*�Cookie: mstshash=Administr Meta JSON brut {"bytes_in":47,"payload_entropy":4.155132734426204,"port_category":"registered","org":"Alferov Aleksey Aleksandrovich","service":null,"app_proto":null,"asn":211486,"country":"RU","dst_port":9576,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":42,"tag_count":0,"anomaly_count":0,"campaign_key":"46a98c4adac5f51e15292fff795f1d407ca1a2b0","event_fingerprint":"cb729b50f4c682e22c1d34e0dbaf477d20ab64df","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":211486,"org":"Alferov Aleksey Aleksandrovich","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"012fca15d97ce99638a1c3f4bf953d2b","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":9576,"risk_score":42},"payload_preview":"\u00…

77.91.71.43

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence