{"ip":"87.229.79.230","exported_at":"2026-10-15T08:17:34+00:00","period_days":1,"metrics":{"events7d":1913,"distinct_ports":1,"distinct_classifications":4,"max_severity":5,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":45,"attack_stage":"probe","attack_chain_stage":"reconnaissance","threat_family":["cryptominer"],"recommended_action":"monitor","confidence":0.6,"risk_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":30,"novelty":0},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":1913,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 45\/100","campaign_hint_fr":"Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)","confidence_breakdown":{"waf":8,"classification":54,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":45,"correlation_boost":10},"persona_hostname":"mail.sensor-1.internal","correlation_flags":["scan_coordonn\u00e9"],"correlation_flags_labels_fr":["Scan coordonn\u00e9"],"confidence_pct":60,"confidence_hint_fr":"Corr\u00e9lation +10","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0554"],"tags_summary":["pat-0554"],"attack_vector":"bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)","protocol_details":{"payload_preview":"\ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000Y\ufffd\ufffdM","port":8333,"service":"bitcoin","service_label_fr":"BITCOIN"},"protocol_summary_fr":"Payload \ufffd\ufffd\ufffd\ufffdversion\u0000\u0000\u0000\u0000\u0000g\u0000\u0000\u0000Y\ufffd\ufffdM \u00b7 BITCOIN:8333","evidence_snippet":"\ufffd\ufffd\ufffd\ufffdversiongY\ufffd\ufffdM","target_port_label":"8333 \u00b7 BITCOIN","emulator_service":"bitcoin","confidence_reason":"Confiance 50 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","classification_reason_label_fr":"Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_factors_fr":"Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10","payload_preview":"\ufffd\ufffd\ufffd\ufffdversiongY\ufffd\ufffdM","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"230.79.229.87.dnsbl.blacklistip.com","listed":true,"available":true,"response":"127.0.0.3","meaning":"Sonde ou scan","label":"Sonde Bitcoin"},"events":[{"id":1956915,"ip":"87.229.79.230","ts":"2026-10-15 04:51:43.000000","proto":"tcp","src_port":34698,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a018504a7fb2ecebed337d7a8d90cede\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000Y\ufffd\ufffdM\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000Y\ufffd\ufffdM\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000Y\ufffd\ufffdM\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000Y\ufffd\ufffdM\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000Y\ufffd\ufffdM\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a1b5368783fc607df770f58687f6a312f1620c7b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000Y\ufffd\ufffdM\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversiongY\ufffd\ufffdM\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000g\\u0000\\u0000\\u0000Y\ufffd\ufffdM\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversiongY\ufffd\ufffdM\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 4, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956909,"ip":"87.229.79.230","ts":"2026-10-15 04:51:42.000000","proto":"tcp","src_port":7876,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022acb6aa20b47e3eb3d1526ccabcbd95d5\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\ufffd\/\ufffdb\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\ufffd\/\ufffdb\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\ufffd\/\ufffdb\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\ufffd\/\ufffdb\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\ufffd\/\ufffdb\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f323ed9fe2b0c19aaae73037c73452fa155bdd38\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\ufffd\/\ufffdb\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\ufffd\ufffd\/\ufffdb\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000\ufffd\\u0000\\u0000\\u0000\ufffd\/\ufffdb\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\ufffd\ufffd\/\ufffdb\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 4, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956903,"ip":"87.229.79.230","ts":"2026-10-15 04:51:40.000000","proto":"tcp","src_port":53017,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224aec786f8f98ed5df3e7fb9d84fdb64e\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222e525014dd3eec1e7676f0a26d26843bff84341a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioni\ufffd\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioni\ufffd\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 4, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956897,"ip":"87.229.79.230","ts":"2026-10-15 04:51:39.000000","proto":"tcp","src_port":36603,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022343b4a67a44958399a41ca9bdad5f9dd\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000@\\u0013\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000@\\u0013\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000@\\u0013\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000@\\u0013\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000@\\u0013\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221e8e463e12b9085ba2fed6a763d8276dc9337d62\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000@\\u0013\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{@\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000@\\u0013\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{@\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 4, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956891,"ip":"87.229.79.230","ts":"2026-10-15 04:51:38.000000","proto":"tcp","src_port":8211,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222181b116c2bdb45f5b315d6a295319cc\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\\u0001\ufffd\\b\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\\u0001\ufffd\\b\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\\u0001\ufffd\\b\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\\u0001\ufffd\\b\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\\u0001\ufffd\\b\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022582495d6ba4d20a2ece6f9cbb1532859ac5d1ad7\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\\u0001\ufffd\\b\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioni\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\\u0001\ufffd\\b\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioni\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 4, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956885,"ip":"87.229.79.230","ts":"2026-10-15 04:51:37.000000","proto":"tcp","src_port":45308,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022de271be3f518c7a814b811b84afdc707\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0011\ufffdb\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0011\ufffdb\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0011\ufffdb\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0011\ufffdb\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0011\ufffdb\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227e91e8d433fa8e63745cea65cc70dcbf06f2dfe1\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0011\ufffdb\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\ufffdb\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u0011\ufffdb\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\ufffdb\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 4, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956879,"ip":"87.229.79.230","ts":"2026-10-15 04:51:35.000000","proto":"tcp","src_port":48122,"dst_port":8333,"service":"bitcoin","classification":"postgres_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 32.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022confidence\u0022: 0.59, \u0022classification_confidence\u0022: 0.59, \u0022precision_score\u0022: 58, \u0022precision_signals\u0022: [\u0022pat-0369\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0369\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 10}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 49.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00225a3e79c107e7503e85b69c725c4d4617\u0022, \u0022path_pattern_hash\u0022: \u002280f3c71fe26f36a0a9399108643f66c5\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\\n`\/_\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\\n`\/_\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\\n`\/_\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\\n`\/_\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\\n`\/_\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b7a85e8441adec2e67dfb04d81da6701653350a2\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\\n`\/_\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionh\\n`\/_\u0022, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 59, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 32.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 35, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0369\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0369\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\\n`\/_\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022postgres probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionh\\n`\/_\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 49 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956873,"ip":"87.229.79.230","ts":"2026-10-15 04:51:34.000000","proto":"tcp","src_port":57098,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022164f920c9768dd8c8f2e081dfb354e65\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000u\\u0000\\u0000\\u0000\ufffd\u0027\ufffde\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000u\\u0000\\u0000\\u0000\ufffd\u0027\ufffde\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000u\\u0000\\u0000\\u0000\ufffd\u0027\ufffde\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000u\\u0000\\u0000\\u0000\ufffd\u0027\ufffde\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000u\\u0000\\u0000\\u0000\ufffd\u0027\ufffde\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00221776d79033195d8c0b7357fcb6e78de932e2c42a\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000u\\u0000\\u0000\\u0000\ufffd\u0027\ufffde\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionu\ufffd\u0027\ufffde\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000u\\u0000\\u0000\\u0000\ufffd\u0027\ufffde\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionu\ufffd\u0027\ufffde\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956839,"ip":"87.229.79.230","ts":"2026-10-15 04:51:33.000000","proto":"tcp","src_port":35457,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c6fb6dddd24600b35f193ce9f8f6f205\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u003E\ufffd:\\f\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u003E\ufffd:\\f\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u003E\ufffd:\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u003E\ufffd:\\f\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u003E\ufffd:\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00226c3e5eb83a06e6008e369253639e8dc032c023d1\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u003E\ufffd:\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\u003E\ufffd:\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\u003E\ufffd:\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\u003E\ufffd:\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956803,"ip":"87.229.79.230","ts":"2026-10-15 04:51:32.000000","proto":"tcp","src_port":14555,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022184c643026e06074ae076d8bf19c4a94\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\\u001c\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\\u001c\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\\u001c\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\\u001c\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\\u001c\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a883ec7cd4bbb393ac122b9eeb955ed8f9c3c796\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\\u001c\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd\\u001c\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956769,"ip":"87.229.79.230","ts":"2026-10-15 04:51:31.000000","proto":"tcp","src_port":62538,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022bbff24aa1af86019808c4e94be16c3ed\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u001e_\ufffdc\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u001e_\ufffdc\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u001e_\ufffdc\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u001e_\ufffdc\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u001e_\ufffdc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fe378cadb07d6000a6dfdf27d0617b952706cdd5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u001e_\ufffdc\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{_\ufffdc\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\\u001e_\ufffdc\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{_\ufffdc\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956736,"ip":"87.229.79.230","ts":"2026-10-15 04:51:29.000000","proto":"tcp","src_port":22974,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022dbdd977d82012ce3fcd7188a6e40aa76\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000x\\u0000\\u0000\\u0000\ufffdB\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000x\\u0000\\u0000\\u0000\ufffdB\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000x\\u0000\\u0000\\u0000\ufffdB\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000x\\u0000\\u0000\\u0000\ufffdB\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000x\\u0000\\u0000\\u0000\ufffdB\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220d8cac7de7bc786da24f47f4dc323a7554a067cf\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000x\\u0000\\u0000\\u0000\ufffdB\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionx\ufffdB\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000x\\u0000\\u0000\\u0000\ufffdB\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionx\ufffdB\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956701,"ip":"87.229.79.230","ts":"2026-10-15 04:51:28.000000","proto":"tcp","src_port":47352,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022807f72e81e6d4d8e8d75ef1ce968d542\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffd\\u001fS\\u0003\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffd\\u001fS\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffd\\u001fS\\u0003\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffd\\u001fS\\u0003\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffd\\u001fS\\u0003\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d1e38beff95bcc5ec87c8b8d92e1d488ff7a71c9\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffd\\u001fS\\u0003\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionq\ufffdS\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000q\\u0000\\u0000\\u0000\ufffd\\u001fS\\u0003\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionq\ufffdS\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956663,"ip":"87.229.79.230","ts":"2026-10-15 04:51:27.000000","proto":"tcp","src_port":37330,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002211c2c31b6fe4134b8c0080199090f5fa\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cc1d25da913f7027a4e65d93ef1d8f454183c2b1\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956629,"ip":"87.229.79.230","ts":"2026-10-15 04:51:26.000000","proto":"tcp","src_port":9473,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002224e12cd75d16f63962e02f08c2384145\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000i\ufffd4\\\u0022\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000i\ufffd4\\\u0022\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000i\ufffd4\\\u0022\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000i\ufffd4\\\u0022\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000i\ufffd4\\\u0022\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002211892efa71640bb066c1cecadb9428753377167f\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000i\ufffd4\\\u0022\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{i\ufffd4\\\u0022\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000i\ufffd4\\\u0022\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{i\ufffd4\\\u0022\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956586,"ip":"87.229.79.230","ts":"2026-10-15 04:51:24.000000","proto":"tcp","src_port":9919,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022107d35a583d983c53f29421a95887290\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd\ufffdw\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd\ufffdw\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd\ufffdw\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd\ufffdw\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd\ufffdw\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222dc3d53a92a7731d2fe9047b770df98e2bc9462b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd\ufffdw\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffdw\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\ufffd\ufffdw\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\ufffd\ufffdw\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956551,"ip":"87.229.79.230","ts":"2026-10-15 04:51:23.000000","proto":"tcp","src_port":8865,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228c9c06423d717ddd4d19695e677de0f1\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000k\\u0000\\u0000\\u0000\ufffd\u04f8\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000k\\u0000\\u0000\\u0000\ufffd\u04f8\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000k\\u0000\\u0000\\u0000\ufffd\u04f8\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000k\\u0000\\u0000\\u0000\ufffd\u04f8\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000k\\u0000\\u0000\\u0000\ufffd\u04f8\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002270b95fac7ed570e3e2129bc76008104741809747\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000k\\u0000\\u0000\\u0000\ufffd\u04f8\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionk\ufffd\u04f8\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000k\\u0000\\u0000\\u0000\ufffd\u04f8\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionk\ufffd\u04f8\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956517,"ip":"87.229.79.230","ts":"2026-10-15 04:51:22.000000","proto":"tcp","src_port":62337,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00223a2daa75cd699e6dc17a56f3b3db9c7b\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd_\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd_\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd_\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd_\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd_\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022799e74921f38e9cf8922c340f2009e1240651a6e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd_\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd_\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffd\ufffd_\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffd\ufffd_\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956482,"ip":"87.229.79.230","ts":"2026-10-15 04:51:21.000000","proto":"tcp","src_port":2741,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022e9279ed7c4f2a03af1c54f7a975d66e7\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000d|\ufffdo\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000d|\ufffdo\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000d|\ufffdo\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000d|\ufffdo\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000d|\ufffdo\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ff7eae919d56a7b1c2ba9c695654a2478b41c075\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000d|\ufffdo\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{d|\ufffdo\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000d|\ufffdo\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{d|\ufffdo\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956446,"ip":"87.229.79.230","ts":"2026-10-15 04:51:19.000000","proto":"tcp","src_port":47455,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224416e8ebe49103590847964b54dac49e\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u01c53\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u01c53\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u01c53\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u01c53\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u01c53\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e3ddb68517bb7d1248df2207869eb36e3430d187\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u01c53\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\u01c53\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000\u01c53\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{\u01c53\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956410,"ip":"87.229.79.230","ts":"2026-10-15 04:51:18.000000","proto":"tcp","src_port":28708,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022cbf547e25c99690e172d8d35e84d836f\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffdYl,\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffdYl,\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffdYl,\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffdYl,\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffdYl,\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e3dd4f43e0844e705defba30b4bb0f1968354281\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffdYl,\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffdYl,\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000f\\u0000\\u0000\\u0000\ufffdYl,\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionf\ufffdYl,\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956375,"ip":"87.229.79.230","ts":"2026-10-15 04:51:17.000000","proto":"tcp","src_port":6112,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002244143b194e5cf321b0f378e4a34aafd9\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffdRL\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffdRL\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffdRL\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffdRL\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffdRL\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002218b345919cd690681cda8e9e2709246a2cce0597\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffdRL\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversione\ufffdRL\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000e\\u0000\\u0000\\u0000\ufffdRL\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversione\ufffdRL\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956339,"ip":"87.229.79.230","ts":"2026-10-15 04:51:16.000000","proto":"tcp","src_port":2711,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.41829583405449, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ce53daabe6d5ddb51817916000559493\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\u003E\u003E\\u000e\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\u003E\u003E\\u000e\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\u003E\u003E\\u000e\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\u003E\u003E\\u000e\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\u003E\u003E\\u000e\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022440eaab2aa2dedba4e7920099843550a744a9049\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\u003E\u003E\\u000e\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioni\ufffd\u003E\u003E\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000i\\u0000\\u0000\\u0000\ufffd\u003E\u003E\\u000e\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversioni\ufffd\u003E\u003E\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956304,"ip":"87.229.79.230","ts":"2026-10-15 04:51:15.000000","proto":"tcp","src_port":34717,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.584962500721157, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022957db2416682ce1c1044c2866f9c1316\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000f\\u0012\ufffd\ufffd\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000f\\u0012\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000f\\u0012\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000f\\u0012\ufffd\ufffd\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000f\\u0012\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002223f474fde3aebc0b764c1e2ee571ace30513b916\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000f\\u0012\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{f\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000{\\u0000\\u0000\\u0000f\\u0012\ufffd\ufffd\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion{f\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24},{"id":1956270,"ip":"87.229.79.230","ts":"2026-10-15 04:51:13.000000","proto":"tcp","src_port":43646,"dst_port":8333,"service":"bitcoin","classification":"bitcoin_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022f9beb4d97d000000000000007f11010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff00000000\u0022, \u0022emulator_response_len\u0022: 130, \u0022bytes_in\u0022: 24, \u0022payload_entropy\u0022: 3.5016291673878235, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022service\u0022: \u0022bitcoin\u0022, \u0022app_proto\u0022: \u0022bitcoin\u0022, \u0022asn\u0022: 401476, \u0022country\u0022: \u0022HU\u0022, \u0022dst_port\u0022: 8333, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 54.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00227d1200fc7f6bdcf80682b9585b48b0b97f6eb2b7\u0022, \u0022event_fingerprint\u0022: \u002234c7621b91cda0c6a21c6948f9570ac241d1b132\u0022, \u0022classification_confidence\u0022: 0.6, \u0022confidence\u0022: 0.6, \u0022precision_signals\u0022: [\u0022pat-0554\u0022], \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022HU\u0022, \u0022asn\u0022: 401476, \u0022org\u0022: \u0022Spruce Creek Networks LLC\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022bd48f02f2525c538cd10b58efb8867a9\u0022, \u0022path_pattern_hash\u0022: \u0022d043bc0163534bf0040acf6d6928f6c0\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\ufffd\ufffdsY\u0022, \u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\ufffd\ufffdsY\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\ufffd\ufffdsY\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\ufffd\ufffdsY\u0022, \u0022payload_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\ufffd\ufffdsY\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cryptominer\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228fb07a3e099de88dfc37f831f1be654e4ac556a5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\ufffd\ufffdsY\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionh\ufffd\ufffdsY\u0022, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab bitcoin_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 45\/100\u0022, \u0022confidence_pct\u0022: 60, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 54.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 10}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022, \u0022dst_port\u0022: 8333, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0554\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0554\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022correlation_flags\u0022: [\u0022scan_coordonn\u00e9\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan coordonn\u00e9\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +10\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversion\\u0000\\u0000\\u0000\\u0000\\u0000h\\u0000\\u0000\\u0000\ufffd\ufffdsY\u0022, \u0022port\u0022: 8333, \u0022service\u0022: \u0022bitcoin\u0022, \u0022service_label_fr\u0022: \u0022BITCOIN\u0022}, \u0022attack_vector\u0022: \u0022bitcoin probe \u00b7 via BITCOIN:8333 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffdversionh\ufffd\ufffdsY\u0022, \u0022target_port_label\u0022: \u00228333 \u00b7 BITCOIN\u0022, \u0022emulator_service\u0022: \u0022bitcoin\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (87.229.79.0\/24, \u22653 pairs)\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022bitcoin\u0022, \u0022service_banner\u0022: \u0022honeypot-bitcoin\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228333\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022coordinated_scan\u0022: true, \u0022coordinated_subnet\u0022: \u002287.229.79.0\/24\u0022, \u0022coordinated_ip_count\u0022: 5, \u0022behavior_alerts\u0022: [\u0022coordinated_scan\u0022], \u0022correlation_confidence_boost\u0022: 10, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022bitcoin_emulated\u0022, \u0022bitcoin_version\u0022, \u0022net_bitcoin_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":24}],"total_events":484}