Détails IP 79.105.249.121

Pourquoi listée

Rafale d'authentification SSH · confiance 95%

Confiance 100 % — Score WAF 8 · Bonus corrélation +8

Comparaison ASN / FAI

ASN 12389 · 79.105.248.0/22 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 42 événements sur la période pour cette IP.

109.61.148.195 Sonde Telnet (23/TCP) 14/10/2026 04:01 UTC
178.45.53.39 Sonde Telnet (23/TCP) 13/10/2026 18:44 UTC
95.152.20.226 Sonde Telnet (23/TCP) 13/10/2026 15:58 UTC
178.184.113.234 Sonde SMB 13/10/2026 13:11 UTC
176.211.17.26 Sonde SMB 13/10/2026 11:37 UTC
90.150.151.178 Sonde SMB 13/10/2026 08:30 UTC
85.175.170.253 Tentative d'exploit 12/10/2026 18:25 UTC
88.200.215.209 Sonde port 11/10/2026 17:07 UTC

IPs apparentées

Même FAI Rostelecom — corrélation indicative.

109.61.148.195 Sonde Telnet (23/TCP)
178.45.53.39 Sonde Telnet (23/TCP)
95.152.20.226 Sonde Telnet (23/TCP)
178.184.113.234 Sonde SMB
176.211.17.26 Sonde SMB

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

VNC TCP 41 RDP TCP 1

VNC

41

RDP

1

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

42 événement(s) — page 2/2

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
14/10/2026 00:39:24 UTC	TCP	5900 · VNC	vnc	Bruteforce VNC vnc bruteforce · via VNC:5900 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1110 TA0007 TA0001 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_bruteforce net_vnc_bruteforce vnc_auth_attempt vnc_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5900 Chemin / cible — Service VNC Payload RFB 003.008 Pourquoi cette classification : Rafale d'authentification SSH · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 95 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Tcp Vnc Auth Upstream Technique MITRE T1110 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) VNC RFB 3.8 User-Agent — Règles WAF — Payload (extrait) RFB 003.008 Meta JSON brut {"protocol_emulated":true,"emulator_response":"524642203030332e3030380a","emulator_response_len":12,"bytes_in":12,"payload_entropy":2.9182958340544896,"port_category":"registered","org":"Rostelecom","service":"vnc","app_proto":"vnc","asn":12389,"country":"RU","dst_port":5900,"risk_waf":8,"risk_classification":68,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":10,"risk_boost":0,"risk_granularity":3.4,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":10},"risk_score":42,"tag_count":5,"anomaly_count":0,"campaign_key":"e5fc8e7c527061a560fc792d0ebb4c1489ef09d9","event_fingerprint":"4224855e75f2a2d841b898f9815ab5cb95ce6365","classification_reason":"Rafale d'authentification SSH \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":107,"precision_signals":["INT-tcp-vnc-auth","INT-upstream"],"kb_rule_ids":["INT-tcp-vnc-auth","INT-upstream"],"matched_patterns":["pat-0552"],"matched_pattern_names":["VNC RFB 3.8"],"pattern_ids":["pat-0552"],"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":10,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"vnc","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"59ac080647b56a2a43715cdf9e630c46","path_pattern_hash":"6577fc…
14/10/2026 00:39:19 UTC	TCP	5900 · VNC	vnc	Bruteforce VNC vnc bruteforce · via VNC:5900 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1110 TA0007 TA0001 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_bruteforce net_vnc_bruteforce vnc_auth_attempt vnc_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5900 Chemin / cible — Service VNC Payload RFB 003.008 Pourquoi cette classification : Rafale d'authentification SSH · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 95 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Tcp Vnc Auth Upstream Technique MITRE T1110 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) VNC RFB 3.8 User-Agent — Règles WAF — Payload (extrait) RFB 003.008 Meta JSON brut {"protocol_emulated":true,"emulator_response":"524642203030332e3030380a","emulator_response_len":12,"bytes_in":12,"payload_entropy":2.9182958340544896,"port_category":"registered","org":"Rostelecom","service":"vnc","app_proto":"vnc","asn":12389,"country":"RU","dst_port":5900,"risk_waf":8,"risk_classification":68,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":10,"risk_boost":0,"risk_granularity":3.4,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":10},"risk_score":42,"tag_count":5,"anomaly_count":0,"campaign_key":"e5fc8e7c527061a560fc792d0ebb4c1489ef09d9","event_fingerprint":"4224855e75f2a2d841b898f9815ab5cb95ce6365","classification_reason":"Rafale d'authentification SSH \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":107,"precision_signals":["INT-tcp-vnc-auth","INT-upstream"],"kb_rule_ids":["INT-tcp-vnc-auth","INT-upstream"],"matched_patterns":["pat-0552"],"matched_pattern_names":["VNC RFB 3.8"],"pattern_ids":["pat-0552"],"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":10,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"vnc","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"59ac080647b56a2a43715cdf9e630c46","path_pattern_hash":"6577fc…
14/10/2026 00:39:14 UTC	TCP	5900 · VNC	vnc	Bruteforce VNC vnc bruteforce · via VNC:5900 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1110 TA0007 TA0001 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_bruteforce net_vnc_bruteforce vnc_auth_attempt vnc_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5900 Chemin / cible — Service VNC Payload RFB 003.008 Pourquoi cette classification : Rafale d'authentification SSH · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 95 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Tcp Vnc Auth Upstream Technique MITRE T1110 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) VNC RFB 3.8 User-Agent — Règles WAF — Payload (extrait) RFB 003.008 Meta JSON brut {"protocol_emulated":true,"emulator_response":"524642203030332e3030380a","emulator_response_len":12,"bytes_in":12,"payload_entropy":2.9182958340544896,"port_category":"registered","org":"Rostelecom","service":"vnc","app_proto":"vnc","asn":12389,"country":"RU","dst_port":5900,"risk_waf":8,"risk_classification":68,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":10,"risk_boost":0,"risk_granularity":3.4,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":10},"risk_score":42,"tag_count":5,"anomaly_count":0,"campaign_key":"e5fc8e7c527061a560fc792d0ebb4c1489ef09d9","event_fingerprint":"4224855e75f2a2d841b898f9815ab5cb95ce6365","classification_reason":"Rafale d'authentification SSH \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":107,"precision_signals":["INT-tcp-vnc-auth","INT-upstream"],"kb_rule_ids":["INT-tcp-vnc-auth","INT-upstream"],"matched_patterns":["pat-0552"],"matched_pattern_names":["VNC RFB 3.8"],"pattern_ids":["pat-0552"],"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":10,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"vnc","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"59ac080647b56a2a43715cdf9e630c46","path_pattern_hash":"6577fc…
14/10/2026 00:39:09 UTC	TCP	5900 · VNC	vnc	Bruteforce VNC vnc bruteforce · via VNC:5900 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1110 TA0007 TA0001 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_bruteforce net_vnc_bruteforce vnc_auth_attempt vnc_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5900 Chemin / cible — Service VNC Payload RFB 003.008 Pourquoi cette classification : Rafale d'authentification SSH · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 95 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Tcp Vnc Auth Upstream Technique MITRE T1110 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) VNC RFB 3.8 User-Agent — Règles WAF — Payload (extrait) RFB 003.008 Meta JSON brut {"protocol_emulated":true,"emulator_response":"524642203030332e3030380a","emulator_response_len":12,"bytes_in":12,"payload_entropy":2.9182958340544896,"port_category":"registered","org":"Rostelecom","service":"vnc","app_proto":"vnc","asn":12389,"country":"RU","dst_port":5900,"risk_waf":8,"risk_classification":68,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":10,"risk_boost":0,"risk_granularity":3.4,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":10},"risk_score":42,"tag_count":5,"anomaly_count":0,"campaign_key":"e5fc8e7c527061a560fc792d0ebb4c1489ef09d9","event_fingerprint":"4224855e75f2a2d841b898f9815ab5cb95ce6365","classification_reason":"Rafale d'authentification SSH \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":107,"precision_signals":["INT-tcp-vnc-auth","INT-upstream"],"kb_rule_ids":["INT-tcp-vnc-auth","INT-upstream"],"matched_patterns":["pat-0552"],"matched_pattern_names":["VNC RFB 3.8"],"pattern_ids":["pat-0552"],"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":10,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"vnc","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"59ac080647b56a2a43715cdf9e630c46","path_pattern_hash":"6577fc…
14/10/2026 00:39:04 UTC	TCP	5900 · VNC	vnc	Bruteforce VNC vnc bruteforce · via VNC:5900 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1110 TA0007 TA0001 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_bruteforce net_vnc_bruteforce vnc_auth_attempt vnc_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5900 Chemin / cible — Service VNC Payload RFB 003.008 Pourquoi cette classification : Rafale d'authentification SSH · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 95 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Tcp Vnc Auth Upstream Technique MITRE T1110 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) VNC RFB 3.8 User-Agent — Règles WAF — Payload (extrait) RFB 003.008 Meta JSON brut {"protocol_emulated":true,"emulator_response":"524642203030332e3030380a","emulator_response_len":12,"bytes_in":12,"payload_entropy":2.9182958340544896,"port_category":"registered","org":"Rostelecom","service":"vnc","app_proto":"vnc","asn":12389,"country":"RU","dst_port":5900,"risk_waf":8,"risk_classification":68,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":10,"risk_boost":0,"risk_granularity":3.4,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":10},"risk_score":42,"tag_count":5,"anomaly_count":0,"campaign_key":"e5fc8e7c527061a560fc792d0ebb4c1489ef09d9","event_fingerprint":"4224855e75f2a2d841b898f9815ab5cb95ce6365","classification_reason":"Rafale d'authentification SSH \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":107,"precision_signals":["INT-tcp-vnc-auth","INT-upstream"],"kb_rule_ids":["INT-tcp-vnc-auth","INT-upstream"],"matched_patterns":["pat-0552"],"matched_pattern_names":["VNC RFB 3.8"],"pattern_ids":["pat-0552"],"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":10,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"vnc","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"59ac080647b56a2a43715cdf9e630c46","path_pattern_hash":"6577fc…
14/10/2026 00:38:59 UTC	TCP	5900 · VNC	vnc	Bruteforce VNC vnc bruteforce · via VNC:5900 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1110 TA0007 TA0001 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_bruteforce net_vnc_bruteforce vnc_auth_attempt vnc_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5900 Chemin / cible — Service VNC Payload RFB 003.008 Pourquoi cette classification : Rafale d'authentification SSH · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 95 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Tcp Vnc Auth Upstream Technique MITRE T1110 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) VNC RFB 3.8 User-Agent — Règles WAF — Payload (extrait) RFB 003.008 Meta JSON brut {"protocol_emulated":true,"emulator_response":"524642203030332e3030380a","emulator_response_len":12,"bytes_in":12,"payload_entropy":2.9182958340544896,"port_category":"registered","org":"Rostelecom","service":"vnc","app_proto":"vnc","asn":12389,"country":"RU","dst_port":5900,"risk_waf":8,"risk_classification":68,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":10,"risk_boost":0,"risk_granularity":3.4,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":10},"risk_score":42,"tag_count":5,"anomaly_count":0,"campaign_key":"e5fc8e7c527061a560fc792d0ebb4c1489ef09d9","event_fingerprint":"4224855e75f2a2d841b898f9815ab5cb95ce6365","classification_reason":"Rafale d'authentification SSH \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":107,"precision_signals":["INT-tcp-vnc-auth","INT-upstream"],"kb_rule_ids":["INT-tcp-vnc-auth","INT-upstream"],"matched_patterns":["pat-0552"],"matched_pattern_names":["VNC RFB 3.8"],"pattern_ids":["pat-0552"],"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":10,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"vnc","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"59ac080647b56a2a43715cdf9e630c46","path_pattern_hash":"6577fc…
14/10/2026 00:38:50 UTC	TCP	5900 · VNC	vnc	Bruteforce VNC vnc bruteforce · via VNC:5900 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1110 TA0007 TA0001 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_bruteforce net_vnc_bruteforce vnc_auth_attempt vnc_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5900 Chemin / cible — Service VNC Payload RFB 003.008 Pourquoi cette classification : Rafale d'authentification SSH · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 95 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Tcp Vnc Auth Upstream Technique MITRE T1110 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) VNC RFB 3.8 User-Agent — Règles WAF — Payload (extrait) RFB 003.008 Meta JSON brut {"protocol_emulated":true,"emulator_response":"524642203030332e3030380a","emulator_response_len":12,"bytes_in":12,"payload_entropy":2.9182958340544896,"port_category":"registered","org":"Rostelecom","service":"vnc","app_proto":"vnc","asn":12389,"country":"RU","dst_port":5900,"risk_waf":8,"risk_classification":68,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":10,"risk_boost":0,"risk_granularity":3.4,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":10},"risk_score":42,"tag_count":5,"anomaly_count":0,"campaign_key":"e5fc8e7c527061a560fc792d0ebb4c1489ef09d9","event_fingerprint":"4224855e75f2a2d841b898f9815ab5cb95ce6365","classification_reason":"Rafale d'authentification SSH \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":107,"precision_signals":["INT-tcp-vnc-auth","INT-upstream"],"kb_rule_ids":["INT-tcp-vnc-auth","INT-upstream"],"matched_patterns":["pat-0552"],"matched_pattern_names":["VNC RFB 3.8"],"pattern_ids":["pat-0552"],"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":10,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"vnc","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"59ac080647b56a2a43715cdf9e630c46","path_pattern_hash":"6577fc…
14/10/2026 00:38:44 UTC	TCP	5900 · VNC	vnc	Bruteforce VNC vnc bruteforce · via VNC:5900 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1110 TA0007 TA0001 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_bruteforce net_vnc_bruteforce vnc_auth_attempt vnc_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5900 Chemin / cible — Service VNC Payload RFB 003.008 Pourquoi cette classification : Rafale d'authentification SSH · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 95 % — 5 signal(aux) capteur Protocole émulé 1 Signaux Tcp Vnc Auth Upstream Technique MITRE T1110 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) VNC RFB 3.8 User-Agent — Règles WAF — Payload (extrait) RFB 003.008 Meta JSON brut {"protocol_emulated":true,"emulator_response":"524642203030332e3030380a","emulator_response_len":12,"bytes_in":12,"payload_entropy":2.9182958340544896,"port_category":"registered","org":"Rostelecom","service":"vnc","app_proto":"vnc","asn":12389,"country":"RU","dst_port":5900,"risk_waf":8,"risk_classification":68,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":10,"risk_boost":0,"risk_granularity":3.4,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":10},"risk_score":42,"tag_count":5,"anomaly_count":0,"campaign_key":"e5fc8e7c527061a560fc792d0ebb4c1489ef09d9","event_fingerprint":"4224855e75f2a2d841b898f9815ab5cb95ce6365","classification_reason":"Rafale d'authentification SSH \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":107,"precision_signals":["INT-tcp-vnc-auth","INT-upstream"],"kb_rule_ids":["INT-tcp-vnc-auth","INT-upstream"],"matched_patterns":["pat-0552"],"matched_pattern_names":["VNC RFB 3.8"],"pattern_ids":["pat-0552"],"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":10,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"vnc","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"59ac080647b56a2a43715cdf9e630c46","path_pattern_hash":"6577fc…
14/10/2026 00:38:42 UTC	TCP	5900 · VNC	vnc	Sonde VNC (5900/TCP) port 5900 tcp · via VNC:5900 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_vnc_probe vnc_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5900 Chemin / cible — Preuve honeypot — Sonde VNC (5900/TCP) Connexion détectée sur le port 5900 (TCP) du capteur simulé. Service VNC Pourquoi cette classification : Type « port_5900_tcp » (signaux protocolaires) · confiance 69% Confiance classification 77% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 69 % — Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Signaux Tcp Vnc Auth Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"524642203030332e3030380a","emulator_response_len":12,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Rostelecom","service":"vnc","app_proto":"vnc","asn":12389,"country":"RU","dst_port":5900,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":42,"tag_count":2,"anomaly_count":0,"campaign_key":"85454e6c29c51aac1db940d56f57ff1075b15dc1","event_fingerprint":"3a1818c09cc3b5e6ad75703011c0dde91c1bf15b","classification_reason":"Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%","confidence":0.77,"classification_confidence":0.77,"precision_score":82,"precision_signals":["INT-tcp-vnc-auth"],"kb_rule_ids":["INT-tcp-vnc-auth"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"vnc_bruteforce","service_name":"vnc","risk_confidence_factor":69,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"4a4cb19f87c1ed9566419ca625731da1"},"target_context":{"dst_port":5900,"service":"vnc","service_name":"vnc","risk…
14/10/2026 00:38:34 UTC	TCP	5900 · VNC	vnc	Bruteforce VNC vnc bruteforce · via VNC:5900 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1110 TA0007 TA0001 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_vnc_bruteforce vnc_auth_attempt vnc_banner vnc_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5900 Chemin / cible — Service VNC Payload RFB 003.008 Pourquoi cette classification : Type « vnc_bruteforce » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 95 % — 4 signal(aux) capteur Protocole émulé 1 Signaux Tcp Vnc Auth Upstream Technique MITRE T1110 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) VNC RFB 3.8 User-Agent — Règles WAF — Payload (extrait) RFB 003.008 Meta JSON brut {"protocol_emulated":true,"emulator_response":"524642203030332e3030380a","emulator_response_len":12,"bytes_in":12,"payload_entropy":2.9182958340544896,"port_category":"registered","org":"Rostelecom","service":"vnc","app_proto":"vnc","asn":12389,"country":"RU","dst_port":5900,"risk_waf":8,"risk_classification":68,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":3,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"be66c1e10cc49cf983619c539468e52da00ee67a","event_fingerprint":"4224855e75f2a2d841b898f9815ab5cb95ce6365","classification_reason":"Type \u00ab vnc_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":107,"precision_signals":["INT-tcp-vnc-auth","INT-upstream"],"kb_rule_ids":["INT-tcp-vnc-auth","INT-upstream"],"matched_patterns":["pat-0552"],"matched_pattern_names":["VNC RFB 3.8"],"pattern_ids":["pat-0552"],"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"vnc","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"59ac080647b56a2a43715cdf9e630c46","pat…
14/10/2026 00:38:29 UTC	TCP	5900 · VNC	vnc	Bruteforce VNC vnc bruteforce · via VNC:5900 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1110 TA0007 TA0001 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_vnc_bruteforce vnc_auth_attempt vnc_banner vnc_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5900 Chemin / cible — Service VNC Payload RFB 003.008 Pourquoi cette classification : Type « vnc_bruteforce » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 95 % — 4 signal(aux) capteur Protocole émulé 1 Signaux Tcp Vnc Auth Upstream Technique MITRE T1110 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) VNC RFB 3.8 User-Agent — Règles WAF — Payload (extrait) RFB 003.008 Meta JSON brut {"protocol_emulated":true,"emulator_response":"524642203030332e3030380a","emulator_response_len":12,"bytes_in":12,"payload_entropy":2.9182958340544896,"port_category":"registered","org":"Rostelecom","service":"vnc","app_proto":"vnc","asn":12389,"country":"RU","dst_port":5900,"risk_waf":8,"risk_classification":68,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":3,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"be66c1e10cc49cf983619c539468e52da00ee67a","event_fingerprint":"4224855e75f2a2d841b898f9815ab5cb95ce6365","classification_reason":"Type \u00ab vnc_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":107,"precision_signals":["INT-tcp-vnc-auth","INT-upstream"],"kb_rule_ids":["INT-tcp-vnc-auth","INT-upstream"],"matched_patterns":["pat-0552"],"matched_pattern_names":["VNC RFB 3.8"],"pattern_ids":["pat-0552"],"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"vnc","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"59ac080647b56a2a43715cdf9e630c46","pat…
14/10/2026 00:38:24 UTC	TCP	5900 · VNC	vnc	Bruteforce VNC vnc bruteforce · via VNC:5900 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1110 TA0007 TA0001 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_vnc_bruteforce vnc_auth_attempt vnc_banner vnc_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5900 Chemin / cible — Service VNC Payload RFB 003.008 Pourquoi cette classification : Type « vnc_bruteforce » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 95 % — 4 signal(aux) capteur Protocole émulé 1 Signaux Tcp Vnc Auth Upstream Technique MITRE T1110 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) VNC RFB 3.8 User-Agent — Règles WAF — Payload (extrait) RFB 003.008 Meta JSON brut {"protocol_emulated":true,"emulator_response":"524642203030332e3030380a","emulator_response_len":12,"bytes_in":12,"payload_entropy":2.9182958340544896,"port_category":"registered","org":"Rostelecom","service":"vnc","app_proto":"vnc","asn":12389,"country":"RU","dst_port":5900,"risk_waf":8,"risk_classification":68,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":3,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"be66c1e10cc49cf983619c539468e52da00ee67a","event_fingerprint":"4224855e75f2a2d841b898f9815ab5cb95ce6365","classification_reason":"Type \u00ab vnc_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":107,"precision_signals":["INT-tcp-vnc-auth","INT-upstream"],"kb_rule_ids":["INT-tcp-vnc-auth","INT-upstream"],"matched_patterns":["pat-0552"],"matched_pattern_names":["VNC RFB 3.8"],"pattern_ids":["pat-0552"],"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"vnc","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"59ac080647b56a2a43715cdf9e630c46","pat…
14/10/2026 00:38:19 UTC	TCP	5900 · VNC	vnc	Bruteforce VNC vnc bruteforce · via VNC:5900 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1110 TA0007 TA0001 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_vnc_bruteforce vnc_auth_attempt vnc_banner vnc_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5900 Chemin / cible — Service VNC Payload RFB 003.008 Pourquoi cette classification : Type « vnc_bruteforce » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 95 % — 4 signal(aux) capteur Protocole émulé 1 Signaux Tcp Vnc Auth Upstream Technique MITRE T1110 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) VNC RFB 3.8 User-Agent — Règles WAF — Payload (extrait) RFB 003.008 Meta JSON brut {"protocol_emulated":true,"emulator_response":"524642203030332e3030380a","emulator_response_len":12,"bytes_in":12,"payload_entropy":2.9182958340544896,"port_category":"registered","org":"Rostelecom","service":"vnc","app_proto":"vnc","asn":12389,"country":"RU","dst_port":5900,"risk_waf":8,"risk_classification":68,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":3,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"be66c1e10cc49cf983619c539468e52da00ee67a","event_fingerprint":"4224855e75f2a2d841b898f9815ab5cb95ce6365","classification_reason":"Type \u00ab vnc_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":107,"precision_signals":["INT-tcp-vnc-auth","INT-upstream"],"kb_rule_ids":["INT-tcp-vnc-auth","INT-upstream"],"matched_patterns":["pat-0552"],"matched_pattern_names":["VNC RFB 3.8"],"pattern_ids":["pat-0552"],"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"vnc","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"59ac080647b56a2a43715cdf9e630c46","pat…
14/10/2026 00:38:14 UTC	TCP	5900 · VNC	vnc	Bruteforce VNC vnc bruteforce · via VNC:5900 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1110 TA0007 TA0001 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_vnc_bruteforce vnc_auth_attempt vnc_banner vnc_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5900 Chemin / cible — Service VNC Payload RFB 003.008 Pourquoi cette classification : Type « vnc_bruteforce » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 95 % — 4 signal(aux) capteur Protocole émulé 1 Signaux Tcp Vnc Auth Upstream Technique MITRE T1110 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) VNC RFB 3.8 User-Agent — Règles WAF — Payload (extrait) RFB 003.008 Meta JSON brut {"protocol_emulated":true,"emulator_response":"524642203030332e3030380a","emulator_response_len":12,"bytes_in":12,"payload_entropy":2.9182958340544896,"port_category":"registered","org":"Rostelecom","service":"vnc","app_proto":"vnc","asn":12389,"country":"RU","dst_port":5900,"risk_waf":8,"risk_classification":68,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":3,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"be66c1e10cc49cf983619c539468e52da00ee67a","event_fingerprint":"4224855e75f2a2d841b898f9815ab5cb95ce6365","classification_reason":"Type \u00ab vnc_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":107,"precision_signals":["INT-tcp-vnc-auth","INT-upstream"],"kb_rule_ids":["INT-tcp-vnc-auth","INT-upstream"],"matched_patterns":["pat-0552"],"matched_pattern_names":["VNC RFB 3.8"],"pattern_ids":["pat-0552"],"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"vnc","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"59ac080647b56a2a43715cdf9e630c46","pat…
14/10/2026 00:38:05 UTC	TCP	5900 · VNC	vnc	Bruteforce VNC vnc bruteforce · via VNC:5900 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1110 TA0007 TA0001 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_vnc_bruteforce vnc_auth_attempt vnc_banner vnc_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5900 Chemin / cible — Service VNC Payload RFB 003.008 Pourquoi cette classification : Type « vnc_bruteforce » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 95 % — 4 signal(aux) capteur Protocole émulé 1 Signaux Tcp Vnc Auth Upstream Technique MITRE T1110 Tactiques MITRE TA0007 TA0001 Motifs de détection (base) VNC RFB 3.8 User-Agent — Règles WAF — Payload (extrait) RFB 003.008 Meta JSON brut {"protocol_emulated":true,"emulator_response":"524642203030332e3030380a","emulator_response_len":12,"bytes_in":12,"payload_entropy":2.9182958340544896,"port_category":"registered","org":"Rostelecom","service":"vnc","app_proto":"vnc","asn":12389,"country":"RU","dst_port":5900,"risk_waf":8,"risk_classification":68,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":3,"risk_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"be66c1e10cc49cf983619c539468e52da00ee67a","event_fingerprint":"4224855e75f2a2d841b898f9815ab5cb95ce6365","classification_reason":"Type \u00ab vnc_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":107,"precision_signals":["INT-tcp-vnc-auth","INT-upstream"],"kb_rule_ids":["INT-tcp-vnc-auth","INT-upstream"],"matched_patterns":["pat-0552"],"matched_pattern_names":["VNC RFB 3.8"],"pattern_ids":["pat-0552"],"confidence_breakdown":{"waf":8,"classification":68,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"service_name":"vnc","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"59ac080647b56a2a43715cdf9e630c46","pat…
14/10/2026 00:38:04 UTC	TCP	5900 · VNC	vnc	Sonde VNC (5900/TCP) port 5900 tcp · via VNC:5900 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur VNC WAF — Recommandation Surveiller Tags net_vnc_probe vnc_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5900 Chemin / cible — Preuve honeypot — Sonde VNC (5900/TCP) Connexion détectée sur le port 5900 (TCP) du capteur simulé. Service VNC Pourquoi cette classification : Type « port_5900_tcp » (signaux protocolaires) · confiance 69% Confiance classification 77% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance 69 % — Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Signaux Tcp Vnc Auth Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"524642203030332e3030380a","emulator_response_len":12,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Rostelecom","service":"vnc","app_proto":"vnc","asn":12389,"country":"RU","dst_port":5900,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":42,"tag_count":2,"anomaly_count":0,"campaign_key":"85454e6c29c51aac1db940d56f57ff1075b15dc1","event_fingerprint":"3a1818c09cc3b5e6ad75703011c0dde91c1bf15b","classification_reason":"Type \u00ab port_5900_tcp \u00bb (signaux protocolaires) \u00b7 confiance 69%","confidence":0.77,"classification_confidence":0.77,"precision_score":82,"precision_signals":["INT-tcp-vnc-auth"],"kb_rule_ids":["INT-tcp-vnc-auth"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"vnc_bruteforce","service_name":"vnc","risk_confidence_factor":69,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"4a4cb19f87c1ed9566419ca625731da1"},"target_context":{"dst_port":5900,"service":"vnc","service_name":"vnc","risk…
14/10/2026 00:38:01 UTC	TCP	3389 · RDP	rdp	Sonde RDP (3389/TCP) port 3389 tcp · via RDP:3389 · (sonde / probe)	Élevée	Moyen · 42
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur RDP WAF — Recommandation Surveiller Tags net_rdp_probe rdp_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3389 Chemin / cible — Preuve honeypot — Sonde RDP (3389/TCP) Connexion détectée sur le port 3389 (TCP) du capteur simulé. Service RDP Pourquoi cette classification : Type « port_3389_tcp » (signaux protocolaires) · confiance 55% Confiance classification 55% Risque capteur Moyen · 42 Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"port_inferred_service":true,"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"Rostelecom","service":"rdp","app_proto":"rdp","asn":12389,"country":"RU","dst_port":3389,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":42,"tag_count":2,"anomaly_count":0,"campaign_key":"aa4bea48009056c8c3884e795b29aa79232ecca7","event_fingerprint":"707be242ce71f14fac23ca7fdd82d854dc2752d8","classification_reason":"Type \u00ab port_3389_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%","confidence":0.55,"classification_confidence":0.55,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":42},"named_classification_skipped":true,"named_candidate":"rdp_probe","service_name":"rdp","risk_confidence_factor":55,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":12389,"org":"Rostelecom","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"eb3d82ddd64e24c65658a8ee92a2ad53"},"target_context":{"dst_port":3389,"service":"rdp","service_name":"rdp","risk_score":42},"attack_stage":"probe","mitre_tactics":["TA0007","TA0001"],"mitre":"TA0007","threat_family":["unknown"],"recommended_client_ac…

79.105.249.121

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence