Fiche IP

Roumanie

80.94.95.109

Activité suspecte · risque 35/100

FAI SS-Net Première vue 14/10/2026 10:41 UTC Dernière vue 20/10/2026 15:50 UTC Risque Moyen

Période 2026-09-23 → 2026-10-23

Moyen 50/100

24h 7j 30j 90j

Synthèse

Score de risque max. 50/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 14/10/2026 10:41 UTC

Dernière observation 20/10/2026 15:50 UTC

Événements (période) 65

Décision conseillée Surveiller Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal TA0007 33 occurrences

Pourquoi listée

Type « Sonde port 2026/TCP » (signaux protocolaires) · confiance 49%

Confiance 57 % — Score WAF 8 · Bonus corrélation +8

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

50/100 Confiance 57 % 65 événements TA0007

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 80.94.95.109
Décision : Investiguer
Score max : 50/100 (Moyen)
Confiance : 57 %
Période : 2026-09-23 → 2026-10-23 · 65 événements
Motif : Type « Sonde port 2026/TCP » (signaux protocolaires) · confiance 49%
MITRE : TA0007
FAI : SS-Net · Roumanie

Comparaison ASN / FAI

ASN 204428 · 80.94.95.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 65 événements sur la période pour cette IP.

80.94.95.115 Sonde SSH 22/10/2026 16:29 UTC
80.94.95.83 Sonde RDP 22/10/2026 10:33 UTC
80.94.95.116 Sonde SSH 21/10/2026 23:36 UTC
80.94.95.9 Sonde port 24363/TCP 17/10/2026 11:19 UTC
80.94.95.105 Sonde RDP 16/10/2026 08:48 UTC
80.94.95.84 Sonde port 15/10/2026 18:06 UTC
80.94.95.66 Sonde port 15/10/2026 17:47 UTC
80.94.95.45 Sonde Oracle TNS 15/10/2026 17:34 UTC

Événements (filtres)

Première observation

14/10/2026 10:41 UTC

Dernière observation

20/10/2026 15:50 UTC

Dernière activité (filtres)

20/10/2026 15:50 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

SSH TCP 28 REMOTEANYTHING TCP 2 RDP TCP 2 CASSANDRA JMX TCP 1 STRATUM TCP 1 GAME UNREAL TCP 1 IRC ALT TCP 1

SSH

REMOTEANYTHING

RDP

CASSANDRA JMX

STRATUM

GAME UNREAL

Géolocalisation

Origine réseau déclarée

Roumanie unknown unknown

FAI / réseau

Opérateur et dernière activité ban

SS-Net 0 Port 2026 Sonde port 2026/TCP

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

port 2026 tcp · port 2026 · (sonde / probe)

Détails protocole

Aperçu payload

�

Port / service

2026

Raison confiance

Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0348

Confiance

57% Corrélation +8

Famille de menace

unknown IP compromise (Emerging Threats open) IP signalée (IPsum, 3 listes ou plus)

MITRE ATT&CK — tactiques observées

Découverte Accès initial

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

65 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

65 événement(s) — page 1/3

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
20/10/2026 15:50:45 UTC	TCP	2026	—	Sonde port 2026/TCP port 2026 tcp · port 2026 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2026 Chemin / cible — Preuve honeypot — Sonde port 2026/TCP Connexion détectée sur le port 2026 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 2026/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":2026,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.8,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"d90158e2d05426c37c6862ef44c57bcf9d8032f6","event_fingerprint":"0f7d59c6654c37c51b885ca1f8d67b21d12792e6","classification_reason":"Type \u00ab port_2026_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_hash"…
20/10/2026 15:49:12 UTC	TCP	3315	—	Sonde port 3315/TCP port 3315 tcp · port 3315 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3315 Chemin / cible — Preuve honeypot — Sonde port 3315/TCP Connexion détectée sur le port 3315 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 3315/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":3315,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.6,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"9572eb19db533dacadf100a310815e516cbb33fd","event_fingerprint":"547f55d565691eb819d95699e0a4df455b0abb4d","classification_reason":"Type \u00ab port_3315_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_hash"…
20/10/2026 15:46:25 UTC	TCP	4000 · REMOTEANYTHING	remoteanything	Sonde port 4000/TCP port 4000 tcp · via REMOTEANYTHING:4000 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Émulateur REMOTEANYTHING WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 4000 Chemin / cible — Preuve honeypot — Sonde port 4000/TCP Connexion détectée sur le port 4000 (TCP) du capteur simulé. Service REMOTEANYTHING Payload � Pourquoi cette classification : Type « Sonde port 4000/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f742072656d6f7465616e797468696e6720726561647920706f72743d343030300d0a","emulator_response_len":45,"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":"remoteanything","app_proto":"remoteanything","asn":204428,"country":"RO","dst_port":4000,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":22,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.2,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":22,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"f88a96a7a2195ddc5425c713492dfeb24a49282e","event_fingerprint":"07cd5f73535b136b58bd81864049efd35e649f3d","classification_reason":"Type \u00ab port_4000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":22,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","service_name":"remoteanything","risk_confidence_factor":49,"city":…
20/10/2026 15:46:06 UTC	TCP	33390	—	Sonde port 33390/TCP port 33390 tcp · port 33390 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 33390 Chemin / cible — Preuve honeypot — Sonde port 33390/TCP Connexion détectée sur le port 33390 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 33390/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":33390,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.5,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"f1533ba9d27a6d9371072bb93a113dcf2ec39d5a","event_fingerprint":"fc424be54cca2a51f781a3b1a80b4c5804e063aa","classification_reason":"Type \u00ab port_33390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_has…
20/10/2026 15:44:33 UTC	TCP	7000 · CASSANDRA JMX	cassandra-jmx	Sonde Cassandra (7000/TCP) port 7000 tcp · via CASSANDRA JMX:7000 · (sonde / probe)	Élevée	Moyen · 41
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Émulateur CASSANDRA-JMX WAF — Recommandation Surveiller Tags cassandra_emulated net_cassandra_probe Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7000 Chemin / cible — Preuve honeypot — Sonde Cassandra (7000/TCP) Connexion détectée sur le port 7000 (TCP) du capteur simulé. Service CASSANDRA JMX Payload � Pourquoi cette classification : Type « Sonde Cassandra (7000/TCP) » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Moyen · 41 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"protocol_emulated":true,"emulator_response":"4f4b0d0a","emulator_response_len":4,"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":"cassandra-jmx","app_proto":"cassandra-jmx","asn":204428,"country":"RO","dst_port":7000,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.7,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":41,"tag_count":2,"anomaly_count":0,"campaign_key":"0f2b3f688e52b847eec81bfc3a7ca929d263c647","event_fingerprint":"0515a90696fafcab67973d1c4c56caf19b56703e","classification_reason":"Type \u00ab port_7000_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":41,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","service_name":"cassandra-jmx","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org…
20/10/2026 15:40:26 UTC	TCP	6666 · IRC ALT	irc-alt	Sonde IRC (6666/TCP) port 6666 tcp · via IRC ALT:6666 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole Émulateur IRC-ALT WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 6666 Chemin / cible — Preuve honeypot — Sonde IRC (6666/TCP) Connexion détectée sur le port 6666 (TCP) du capteur simulé. Service IRC ALT Payload � Pourquoi cette classification : Type « Sonde IRC (6666/TCP) » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Protocole émulé 1 Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"protocol_emulated":true,"emulator_response":"3a686f6e6579706f742e69726320303031206775657374203a57656c636f6d6520746f20686f6e6579706f74204952430d0a","emulator_response_len":50,"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":"irc-alt","app_proto":"irc-alt","asn":204428,"country":"RO","dst_port":6666,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":22,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.2,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":22,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"2942165fd692cfaa6cdf826c207b19bf65cf2da8","event_fingerprint":"cc099e4209131811d1d4777bc753e7344e7f3434","classification_reason":"Type \u00ab port_6666_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.49,"classification_confidence":0.49,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":22,"novelty":0,"risk_score":35},"named_classification_skipped":true,"named_candidate":"rdp_probe","service_name":"irc-alt","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_to…
20/10/2026 15:30:27 UTC	TCP	3313	—	Sonde port 3313/TCP port 3313 tcp · port 3313 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3313 Chemin / cible — Preuve honeypot — Sonde port 3313/TCP Connexion détectée sur le port 3313 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 3313/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":3313,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.3,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"8e134dd2c2eb97aba1b4d3be94f3c3f50aa6e6f2","event_fingerprint":"46f5e1a7467f6648527e3f0ed0ae2c1d3a4a3a7e","classification_reason":"Type \u00ab port_3313_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_hash"…
20/10/2026 15:28:33 UTC	TCP	3329	—	Sonde port 3329/TCP port 3329 tcp · port 3329 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3329 Chemin / cible — Preuve honeypot — Sonde port 3329/TCP Connexion détectée sur le port 3329 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 3329/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":3329,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.9,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"d9ebab377735edcbb531bb843fd5d81e87c0056b","event_fingerprint":"98407cb91ac9fb19b312b27fc3aec78e661256aa","classification_reason":"Type \u00ab port_3329_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_hash"…
20/10/2026 15:27:29 UTC	TCP	2000	—	Sonde port 2000 Sonde port · port 2000 · (sonde / probe)	Faible	Faible · 33
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2000 Chemin / cible — Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 0% Confiance classification 8% Corrélation +8 Risque capteur Faible · 33 Confiance : Confiance faible (0 %) — classification prudente Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial User-Agent — Règles WAF — Meta JSON brut {"bytes_in":0,"payload_entropy":0,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":2000,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":33,"tag_count":0,"anomaly_count":0,"campaign_key":"5a634e551014d9c62e2900712ecdf6c1dc72f0b0","event_fingerprint":"23ef2bdab548313f7771f0ca347bc810b7aa0f7e","classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":33,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":2000,"risk_score":33},"attack_stage":"probe","mitre_tactics":["TA0007","TA0001"],"mitre":"TA0007","threat_family":["scanner"],"recommended_client_action":"monitor","policy_mode":"intelligence","sensor_role":"threat_intelligence","event_signature":"b4f403b3b141608f0bc44f2274a0925030d…
20/10/2026 15:27:29 UTC	TCP	3304	—	Sonde port 3304/TCP port 3304 tcp · port 3304 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3304 Chemin / cible — Preuve honeypot — Sonde port 3304/TCP Connexion détectée sur le port 3304 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 3304/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":3304,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.9,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"038b419d6176ecd641dac8a0f1e421b3cd88dc63","event_fingerprint":"fd20a6f7abb7138d4c8e9a554632ced3470918a3","classification_reason":"Type \u00ab port_3304_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_hash"…
20/10/2026 15:24:41 UTC	TCP	33397	—	Sonde port 33397/TCP port 33397 tcp · port 33397 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 33397 Chemin / cible — Preuve honeypot — Sonde port 33397/TCP Connexion détectée sur le port 33397 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 33397/TCP » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":33397,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.6,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"ed1afab997d70ce976c7ad7f6400f4bce0a719e1","event_fingerprint":"60f5b06cb842a80ccbc27f0cda54fbe4ae27697c","classification_reason":"Type \u00ab port_33397_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.49,"classification_confidence":0.49,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_hash":"d4b403513d79cb4ef3…
20/10/2026 15:18:42 UTC	TCP	33393	—	Sonde port 33393/TCP port 33393 tcp · port 33393 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 33393 Chemin / cible — Preuve honeypot — Sonde port 33393/TCP Connexion détectée sur le port 33393 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 33393/TCP » (signaux protocolaires) · confiance 49% Confiance classification 49% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":33393,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"c395fb1b0a778f3b9a2416b43bad98c663ea508a","event_fingerprint":"1885b52c77aebaf8e66cf4547e342b6775f72148","classification_reason":"Type \u00ab port_33393_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.49,"classification_confidence":0.49,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_hash":"e09dbc1d753ce4b3b754…
20/10/2026 15:12:28 UTC	TCP	3336	—	Scan de ports port scan syn · port 3336 · (reconnaissance)	Faible	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3336 Chemin / cible — Payload � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance élevée (100 %) — signaux convergents Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":3336,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":42,"tag_count":0,"anomaly_count":0,"campaign_key":"c400939c30aa4dd41f1e60cb43e284a4df0d8648","event_fingerprint":"7e3eb007463426e9a8d7a1f17d02ccdf19d862d0","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"pa…
20/10/2026 15:12:18 UTC	TCP	3341	—	Sonde port 3341/TCP port 3341 tcp · port 3341 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3341 Chemin / cible — Preuve honeypot — Sonde port 3341/TCP Connexion détectée sur le port 3341 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 3341/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":3341,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.8,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"3a9ab7243e83d6eab7d913ead3e5383f5359c575","event_fingerprint":"3edd48bdce177d011e70e24a2b5067a4343a524b","classification_reason":"Type \u00ab port_3341_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_hash"…
20/10/2026 15:11:50 UTC	TCP	3334	—	Sonde port 3334/TCP port 3334 tcp · port 3334 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3334 Chemin / cible — Preuve honeypot — Sonde port 3334/TCP Connexion détectée sur le port 3334 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 3334/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":3334,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.7,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"f132f9df7c348e13463f4ae6874c9c9428a8b8a7","event_fingerprint":"ddea1c6bb1312a914e62c0f56678c03a8c037762","classification_reason":"Type \u00ab port_3334_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_hash"…
20/10/2026 15:09:32 UTC	TCP	33391	—	Sonde port 33391/TCP port 33391 tcp · port 33391 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 33391 Chemin / cible — Preuve honeypot — Sonde port 33391/TCP Connexion détectée sur le port 33391 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 33391/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":33391,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.6,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"8da797ee1529358074af31ed1b2ab69a6bf2d47d","event_fingerprint":"0b9f87bdbe9d5059f6649eea504bd3b824faf85f","classification_reason":"Type \u00ab port_33391_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_has…
20/10/2026 15:08:25 UTC	TCP	3394	—	Sonde port 3394/TCP port 3394 tcp · port 3394 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3394 Chemin / cible — Preuve honeypot — Sonde port 3394/TCP Connexion détectée sur le port 3394 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 3394/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":3394,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.4,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"b3052d938d207e962fbe3afca229ec31f555a219","event_fingerprint":"b92479d3218f7701dd2d59180e93e611150a2afe","classification_reason":"Type \u00ab port_3394_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_hash"…
20/10/2026 15:06:19 UTC	TCP	3390 · RDP	rdp	Sonde RDP rdp probe · via RDP:3390 · (sonde / probe)	Élevée	Moyen · 48
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole Émulateur RDP WAF — Recommandation Surveiller Tags net_rdp_probe rdp_cookie rdp_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3390 Chemin / cible — Service RDP Payload � Pourquoi cette classification : Négociation protocole RDP · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 48 Confiance : Confiance 95 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0348 Upstream Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"protocol_emulated":true,"emulator_response":"030000130ed00000123400021f080000000000","emulator_response_len":19,"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":"rdp","app_proto":"rdp","asn":204428,"country":"RO","dst_port":3390,"risk_waf":8,"risk_classification":52,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.8,"risk_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":48,"tag_count":3,"anomaly_count":0,"campaign_key":"4d43a9aee13350a4f2414bd1a80e51e6af2cbed6","event_fingerprint":"700e745442e0a767acc5398300bd052d20e6e907","classification_reason":"N\u00e9gociation protocole RDP \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":83,"precision_signals":["pat-0348","INT-upstream"],"kb_rule_ids":["pat-0348","INT-upstream"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":52,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":48,"correlation_boost":8},"named_classification_skipped":false,"service_name":"rdp","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":fal…
20/10/2026 15:04:52 UTC	TCP	3350	—	Sonde port 3350/TCP port 3350 tcp · port 3350 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3350 Chemin / cible — Preuve honeypot — Sonde port 3350/TCP Connexion détectée sur le port 3350 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 3350/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":3350,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.3,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"7799d0917f4fc0b4d2afa7445ab40c9e3ea3e9b2","event_fingerprint":"b9b9cba8ddee34b6160ece9aa2c360f0b4517300","classification_reason":"Type \u00ab port_3350_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_hash"…
20/10/2026 15:02:15 UTC	TCP	3386	—	Sonde port 3386/TCP port 3386 tcp · port 3386 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3386 Chemin / cible — Preuve honeypot — Sonde port 3386/TCP Connexion détectée sur le port 3386 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 3386/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":3386,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.1,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"dfd1b96371463e01a1d950c51e084ece16d826f6","event_fingerprint":"bfb1a8ad59cf2c5cbd5aab89a0b6b9c513d0baf7","classification_reason":"Type \u00ab port_3386_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_hash"…
20/10/2026 15:01:38 UTC	TCP	13397	—	Sonde port 13397/TCP port 13397 tcp · port 13397 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 13397 Chemin / cible — Preuve honeypot — Sonde port 13397/TCP Connexion détectée sur le port 13397 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 13397/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":13397,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.8,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"4f3461c3c5b3584f98074fa2dcec75ad0a1b05f9","event_fingerprint":"ec83285a7cf6d7f6bb990ccb6d65bcf5c10b6f11","classification_reason":"Type \u00ab port_13397_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_has…
20/10/2026 14:57:55 UTC	TCP	1111	—	Sonde port 1111/TCP port 1111 tcp · port 1111 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1111 Chemin / cible — Preuve honeypot — Sonde port 1111/TCP Connexion détectée sur le port 1111 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 1111/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":1111,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.2,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"fcddd26393509d935e338a24c8283e6fffb774cf","event_fingerprint":"9194911aa30c5e3ba50705e2568f8ca47c8317a7","classification_reason":"Type \u00ab port_1111_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_hash"…
20/10/2026 14:57:02 UTC	TCP	13395	—	Sonde port 13395/TCP port 13395 tcp · port 13395 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 13395 Chemin / cible — Preuve honeypot — Sonde port 13395/TCP Connexion détectée sur le port 13395 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 13395/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":13395,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.5,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"23fe5ce54a690a946edf0cd915af39dcdf2866b7","event_fingerprint":"1e6c8c74f5398d7aa3c03315bbfb56368fd27bdc","classification_reason":"Type \u00ab port_13395_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_has…
20/10/2026 14:55:11 UTC	TCP	13398	—	Scan de ports port scan syn · port 13398 · (reconnaissance)	Faible	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 13398 Chemin / cible — Payload � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 42 Confiance : Confiance élevée (100 %) — signaux convergents Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":13398,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":42,"tag_count":0,"anomaly_count":0,"campaign_key":"ca73d32da729ca6a35fa46e4166f152364bf09fc","event_fingerprint":"aa32bbc11a7ccde6fa7c9a762e216e3581785d6c","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":42,"correlation_boost":8},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"p…
20/10/2026 14:55:10 UTC	TCP	3383	—	Sonde port 3383/TCP port 3383 tcp · port 3383 · (sonde / probe)	Faible	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 Découverte Accès Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3383 Chemin / cible — Preuve honeypot — Sonde port 3383/TCP Connexion détectée sur le port 3383 (TCP) du capteur simulé. Payload � Pourquoi cette classification : Type « Sonde port 3383/TCP » (signaux protocolaires) · confiance 49% Confiance classification 57% Corrélation +8 Risque capteur Faible · 35 Confiance : Confiance 49 % — Motif catalogue confirmé · Classification nommée non retenue — preuves insuffisantes Signaux pat-0348 Technique MITRE TA0007 Tactiques MITRE Découverte Accès initial Motifs de détection (base) RDP TPKT header ET H.323 setup Minecraft varint handshake TFTP RRQ User-Agent — Règles WAF — Payload (extrait) � Meta JSON brut {"bytes_in":19,"payload_entropy":1.8784775129881184,"port_category":"registered","org":"SS-Net","service":null,"app_proto":null,"asn":204428,"country":"RO","dst_port":3383,"risk_waf":8,"risk_classification":38,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.6,"risk_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":35,"tag_count":0,"anomaly_count":0,"campaign_key":"24b5131da2a716c8fcb60dd2d9080c304043ed5b","event_fingerprint":"9deb09ead83a5262c0e01df820982cfd172bbc06","classification_reason":"Type \u00ab port_3383_tcp \u00bb (signaux protocolaires) \u00b7 confiance 49%","confidence":0.57,"classification_confidence":0.57,"precision_score":58,"precision_signals":["pat-0348"],"kb_rule_ids":["pat-0348"],"matched_patterns":["pat-0348","pat-0868","pat-0554","pat-0536"],"matched_pattern_names":["RDP TPKT header","ET H.323 setup","Minecraft varint handshake","TFTP RRQ"],"pattern_ids":["pat-0348","pat-0868","pat-0554","pat-0536"],"confidence_breakdown":{"waf":8,"classification":38,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":35,"correlation_boost":8},"named_classification_skipped":true,"named_candidate":"rdp_probe","risk_confidence_factor":49,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RO","asn":204428,"org":"SS-Net","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"c7fc4bd4bc65329ae66eeb0073ae405e","path_pattern_hash"…

80.94.95.109

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence