Détails IP 91.231.89.21

Pourquoi listée

Type « tls_probe » (signaux protocolaires) · confiance 50%

Confiance 50 % — Score WAF 8

Comparaison ASN / FAI

ASN 213412 · 91.231.89.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 13 événements sur la période pour cette IP.

91.231.89.169 Sonde TLS 13/10/2026 11:08 UTC
91.231.89.170 Sonde TLS 13/10/2026 11:08 UTC
91.230.168.105 Sonde port 13/10/2026 11:05 UTC
91.230.168.205 Sonde TLS 13/10/2026 11:05 UTC
91.230.168.24 Sonde TLS 13/10/2026 11:05 UTC
91.230.168.17 Sonde TLS 13/10/2026 11:05 UTC
91.230.168.172 Sonde TLS 13/10/2026 11:04 UTC
91.230.168.168 Sonde TLS 13/10/2026 11:04 UTC

IPs apparentées

Même FAI ONYPHE SAS — corrélation indicative.

91.231.89.169 Sonde TLS
91.231.89.170 Sonde TLS
91.230.168.105 Sonde port
91.230.168.205 Sonde TLS
91.230.168.24 Sonde TLS

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

TLS TCP 10 HTTPS ALT 20443 TCP 1 HTTP ALT 8880 TCP 1

TLS

10

HTTPS ALT 20443

1

HTTP ALT 8880

1

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

De

À

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

13 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
13/10/2026 10:53:10 UTC	TCP	3318 · TLS	tls	Sonde TLS tls probe · via TLS:3318 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 cd350275e54f0c0d Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 3318 Chemin / cible — Service TLS Payload �wǷ�}���X��_�ɾi>�f#$��Y u �t<"��?�𷹗�Vߖʑ��[Yd>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �wǷ�}���X��_�ɾi>�f#$��Y u �t<"��?�𷹗�Vߖʑ��[Yd>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Requête brute (extrait) �wǷ�}���X��_�ɾi>�f#$��Y u �t<"��?�𷹗�Vߖʑ��[Yd>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3��=<5/�u # ( +- Meta JSON brut { "tls_ja3_hash": "cd350275e54f0c0d6df9f3c93af0211d", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 8, "bytes_in": 517, "payload_entropy": 3.9826082974977863, "port_category": "registered", "org": "ONYPHE SAS", "service": "tls", "app_proto": "tls", "asn": 213412, "country": "FR", "dst_port": 3318, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 1.2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "568c667ee7bee0e4857f3fba5c26aeea48f1e094", "event_fingerprint": "64356020f027e28b8859492c141d3119ad9f657e", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 213412, "org": "ONYPHE SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cd350275e54f0c0d6df9f3c93af0211d", "payload_hash": "614cbc2096fb5e65088e6b22c20e2cda", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 3318, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001bw\u01f7\u0015\ufffd}\ufffd\ufffd\ufffd\u000eX\ufffd\ufffd\ufffd_\ufffd\u027e\u0006i\u0013>\ufffdf#$\u001a\ufffd\ufffdY u \ufffdt<\u0015\"\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ud89f\ude57\ufffdV\u07d6\u0291\ufffd\ufffd\ufffd[Yd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001bw\u01f7\u0015\ufffd}\ufffd\ufffd\ufffd\u000eX\ufffd\ufffd\ufffd_\ufffd\u027e\u0006i\u0013>\ufffdf#$\u001a\ufffd\ufffdY u \ufffdt<\u0015\"\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ud89f\ude57\ufffdV\u07d6\u0291\ufffd\ufffd\ufffd[Yd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001bw\u01f7\u0015\ufffd}\ufffd\ufffd\ufffd\u000eX\ufffd\ufffd\ufffd_\ufffd\u027e\u0006i\u0013>\ufffdf#$\u001a\ufffd\ufffdY u \ufffdt<\u0015\"\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ud89f\ude57\ufffdV\u07d6\u0291\ufffd\ufffd\ufffd[Yd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c51ac8cb1e42094f1250809a7c496be6f64f9996", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001bw\u01f7\u0015\ufffd}\ufffd\ufffd\ufffd\u000eX\ufffd\ufffd\ufffd_\ufffd\u027e\u0006i\u0013>\ufffdf#$\u001a\ufffd\ufffdY u \ufffdt<\u0015\"\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ud89f\ude57\ufffdV\u07d6\u0291\ufffd\ufffd\ufffd[Yd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "tls_ja3": "cd350275e54f0c0d6df9f3c93af0211d", "port": 3318, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdw\u01f7\ufffd}\ufffd\ufffd\ufffdX\ufffd\ufffd\ufffd_\ufffd\u027ei>\ufffdf#$\ufffd\ufffdY u \ufffdt<\"\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ud89f\ude57\ufffdV\u07d6\u0291\ufffd\ufffd\ufffd[Yd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd", "attack_vector": "tls probe \u00b7 via TLS:3318 \u00b7 (sonde \/ probe)", "target_port_label": "3318 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 3318, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\u001bw\u01f7\u0015\ufffd}\ufffd\ufffd\ufffd\u000eX\ufffd\ufffd\ufffd_\ufffd\u027e\u0006i\u0013>\ufffdf#$\u001a\ufffd\ufffdY u \ufffdt<\u0015\"\u0014\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ud89f\ude57\ufffdV\u07d6\u0291\ufffd\ufffd\ufffd[Yd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "tls_ja3": "cd350275e54f0c0d6df9f3c93af0211d", "port": 3318, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:3318 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffdw\u01f7\ufffd}\ufffd\ufffd*\ufffdX\ufffd\ufffd\ufffd_\ufffd\u027ei>\ufffdf#$\ufffd\ufffdY u \ufffdt<\"\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd?\ufffd\ud89f\ude57\ufffdV\u07d6\u0291\ufffd\ufffd\ufffd[Yd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd", "target_port_label": "3318 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "3318" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
13/10/2026 10:10:16 UTC	TCP	8880 · HTTP ALT 8880	http-alt-8880	Sonde HTTP 8880 http-alt-8880 · via HTTP ALT 8880:8880 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole Émulateur HTTP-ALT-8880 WAF — Recommandation Surveiller Tags tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8880 Chemin / cible — Service HTTP ALT 8880 Payload _[��aBc:ꢴ��f�w?�� c&�7:��p�C ̽� �g<��3ߗ+��}� +0��)=��3g��9k��E�� #��+� �$�� Pourquoi cette classification : Type « http-alt-8880 » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) _[��aBc:ꢴ��f�w?��c&�7:��p�C ̽� �g<��3ߗ+��}�+0��)=��3g��9k��E�� #��+� �$�� Requête brute (extrait) _[��aBc:ꢴ��f�w?�� c&�7:��p�C ̽� �g<��3ߗ+��}� +0��)=��3g��9k��E�� #��+� �$��,�r�s̩��'�/��(�0�`�a�v�w̨�� /<��5=��A�� 62.3.50.33 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 612, "payload_entropy": 4.289556608620725, "port_category": "registered", "org": "ONYPHE SAS", "service": "http-alt-8880", "app_proto": "http-alt-8880", "asn": 213412, "country": "FR", "dst_port": 8880, "risk_waf": 8, "risk_classification": 24, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0 }, "risk_score": 35, "tag_count": 1, "anomaly_count": 0, "campaign_key": "a678a325f39f135d725fa17d8a0ab23c974128d7", "event_fingerprint": "cd275046284c79b2c8b267829c0a7456b4c77905", "classification_confidence": 0.6, "confidence": 0.6, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab http-alt-8880 \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35, "correlation_boost": 10 }, "service_name": "http-alt-8880", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 213412, "org": "ONYPHE SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "a4f51e4c0ae1c0d0cdeefdbec921d852", "path_pattern_hash": "1da24bfe41e285bcb59da34bdc01a7f0" }, "target_context": { "dst_port": 8880, "service": "http-alt-8880", "service_name": "http-alt-8880", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\ufffd\ufffdaBc:\ua8b4\ufffd\ufffd\ufffdf\ufffdw?\ufffd\ufffd\fc&\u0002\ufffd7:\u001a\ufffd\ufffdp\ufffdC \u033d\u000f\ufffd \ufffdg<\ufffd\ufffd\ufffd\ufffd3\u07d7+\ufffd\ufffd}\ufffd\f+\u00010\u001a\ufffd\ufffd)=\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\ufffd\ufffdaBc:\ua8b4\ufffd\ufffd\ufffdf\ufffdw?\ufffd\ufffd\fc&\u0002\ufffd7:\u001a\ufffd\ufffdp\ufffdC \u033d\u000f\ufffd \ufffdg<\ufffd\ufffd\ufffd\ufffd3\u07d7+\ufffd\ufffd}\ufffd\f+\u00010\u001a\ufffd\ufffd)=\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0001\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000", "payload_snippet": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\ufffd\ufffdaBc:\ua8b4\ufffd\ufffd\ufffdf\ufffdw?\ufffd\ufffd\fc&\u0002\ufffd7:\u001a\ufffd\ufffdp\ufffdC \u033d\u000f\ufffd \ufffdg<\ufffd\ufffd\ufffd\ufffd3\u07d7+\ufffd\ufffd}\ufffd\f+\u00010\u001a\ufffd\ufffd)=\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "classification_reason": "Type \u00ab http-alt-8880 \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "3c7149adc225d7d144612e02cf3c4c5b3825e13e", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\ufffd\ufffdaBc:\ua8b4\ufffd\ufffd\ufffdf\ufffdw?\ufffd\ufffd\fc&\u0002\ufffd7:\u001a\ufffd\ufffdp\ufffdC \u033d\u000f\ufffd \ufffdg<\ufffd\ufffd\ufffd\ufffd3\u07d7+\ufffd\ufffd}\ufffd\f+\u00010\u001a\ufffd\ufffd)=\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "port": 8880, "service": "http-alt-8880", "service_label_fr": "HTTP ALT 8880" }, "evidence_snippet": "_[\ufffd\ufffdaBc:\ua8b4\ufffd\ufffd\ufffdf\ufffdw?\ufffd\ufffdc&\ufffd7:\ufffd\ufffdp\ufffdC \u033d\ufffd \ufffdg<\ufffd\ufffd\ufffd\ufffd3\u07d7+\ufffd\ufffd}\ufffd+0\ufffd\ufffd)=\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "attack_vector": "http-alt-8880 \u00b7 via HTTP ALT 8880:8880 \u00b7 (sonde \/ probe)", "target_port_label": "8880 \u00b7 HTTP ALT 8880", "emulator_service": "http-alt-8880", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab http-alt-8880 \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab http-alt-8880 \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 8, "classification": 24, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 0, "risk_score": 35, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 35, "risk_label": "Faible", "service_name": "http-alt-8880", "service_label_fr": "HTTP ALT 8880", "dst_port": 8880, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http-alt-8880", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\ufffd\ufffdaBc:\ua8b4\ufffd\ufffd\ufffdf\ufffdw?\ufffd\ufffd\fc&\u0002\ufffd7:\u001a\ufffd\ufffdp\ufffdC \u033d\u000f\ufffd \ufffdg<\ufffd\ufffd\ufffd\ufffd3\u07d7+\ufffd\ufffd}\ufffd\f+\u00010\u001a\ufffd\ufffd)=\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "port": 8880, "service": "http-alt-8880", "service_label_fr": "HTTP ALT 8880" }, "attack_vector": "http-alt-8880 \u00b7 via HTTP ALT 8880:8880 \u00b7 (sonde \/ probe)", "evidence_snippet": "_[\ufffd\ufffdaBc:\ua8b4\ufffd\ufffd\ufffdf\ufffdw?\ufffd\ufffdc&\ufffd7:\ufffd\ufffdp\ufffdC \u033d\ufffd \ufffdg<\ufffd\ufffd\ufffd\ufffd3\u07d7+\ufffd\ufffd}\ufffd+0\ufffd\ufffd)=\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "target_port_label": "8880 \u00b7 HTTP ALT 8880", "emulator_service": "http-alt-8880", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (91.231.89.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http_alt_8880", "service_banner": "honeypot-http-alt-8880", "service_os": "linux", "dst_port": "8880" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "91.231.89.0\/24", "coordinated_ip_count": 5, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_clienthello" ] }
13/10/2026 09:53:09 UTC	TCP	1200 · TLS	tls	Sonde TLS tls probe · via TLS:1200 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 4ab40ed46d2f0f15 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 1200 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload _[ }�� m�ʼ�+M?�?�Ł�ں?��ˢ�o� �"�^�M3��3�Cͻ�� 3g��9k��E�� #��+� �$�� Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) _[}��m�ʼ�+M?�?�Ł�ں?��ˢ�o� �"�^�M3��3�Cͻ�� 3g��9k��E�� #��+� �$�� Requête brute (extrait) _[ }�� m�ʼ�+M?�?�Ł�ں?��ˢ�o� �"�^�M3��3�Cͻ�� 3g��9k��E�� #��+� �$��,�r�s̩��'�/��(�0�`�a�v�w̨�� /<��5=��A�� 62.3.50.33 Meta JSON brut { "tls_ja3_hash": "4ab40ed46d2f0f15292e2ccc59b55f0d", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 20, "bytes_in": 612, "payload_entropy": 4.333236453483535, "port_category": "registered", "org": "ONYPHE SAS", "service": "tls", "app_proto": "tls", "asn": 213412, "country": "FR", "dst_port": 1200, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "0691d600a374615d929e74c0f263ae58fb07a24d", "event_fingerprint": "91849cb1549f029839464020f1ed3649810c6762", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 213412, "org": "ONYPHE SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "4ab40ed46d2f0f15292e2ccc59b55f0d", "payload_hash": "b463ac953e2e612d120f4652685d0d54", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 1200, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\u000b}\ufffd\ufffd\fm\ufffd\u02bc\ufffd+M?\ufffd?\ufffd\u0141\ufffd\u06ba?\ufffd\ufffd\u02e2\ufffd\u001ao\ufffd \ufffd\"\ufffd^\ufffdM3\ufffd\ufffd\u0001\ufffd\ufffd\ufffd\u001c\ufffd\u001d\ufffd\ufffd\ufffd3\ufffdC\u037b\u000f\ufffd\ufffd\u0011\ufffd\n\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\u000b}\ufffd\ufffd\fm\ufffd\u02bc\ufffd+M?\ufffd?\ufffd\u0141\ufffd\u06ba?\ufffd\ufffd\u02e2\ufffd\u001ao\ufffd \ufffd\"\ufffd^\ufffdM3\ufffd\ufffd\u0001\ufffd\ufffd\ufffd\u001c\ufffd\u001d\ufffd\ufffd\ufffd3\ufffdC\u037b\u000f\ufffd\ufffd\u0011\ufffd\n\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0001\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000", "payload_snippet": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\u000b}\ufffd\ufffd\fm\ufffd\u02bc\ufffd+M?\ufffd?\ufffd\u0141\ufffd\u06ba?\ufffd\ufffd\u02e2\ufffd\u001ao\ufffd \ufffd\"\ufffd^\ufffdM3\ufffd\ufffd\u0001\ufffd\ufffd\ufffd\u001c\ufffd\u001d\ufffd\ufffd\ufffd3\ufffdC\u037b\u000f\ufffd\ufffd\u0011\ufffd\n\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "4dc73593e1909f0d9073635e5c63bab5a11d66ad", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\u000b}\ufffd\ufffd\fm\ufffd\u02bc\ufffd+M?\ufffd?\ufffd\u0141\ufffd\u06ba?\ufffd\ufffd\u02e2\ufffd\u001ao\ufffd \ufffd\"\ufffd^\ufffdM3\ufffd\ufffd\u0001\ufffd\ufffd\ufffd\u001c\ufffd\u001d\ufffd\ufffd\ufffd3\ufffdC\u037b\u000f\ufffd\ufffd\u0011\ufffd\n\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "4ab40ed46d2f0f15292e2ccc59b55f0d", "tls_sni": "62.3.50.33", "port": 1200, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "_[}\ufffd\ufffdm\ufffd\u02bc\ufffd+M?\ufffd?\ufffd\u0141\ufffd\u06ba?\ufffd\ufffd\u02e2\ufffdo\ufffd \ufffd\"\ufffd^\ufffdM3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffdC\u037b\ufffd\ufffd\ufffd\n\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "attack_vector": "tls probe \u00b7 via TLS:1200 \u00b7 (sonde \/ probe)", "target_port_label": "1200 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 1200, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\u000b}\ufffd\ufffd\fm\ufffd\u02bc\ufffd+M?\ufffd?\ufffd\u0141\ufffd\u06ba?\ufffd\ufffd\u02e2\ufffd\u001ao\ufffd \ufffd\"\ufffd^\ufffdM3\ufffd\ufffd\u0001\ufffd\ufffd\ufffd\u001c\ufffd\u001d\ufffd\ufffd\ufffd3\ufffdC\u037b\u000f\ufffd\ufffd\u0011\ufffd\n\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "4ab40ed46d2f0f15292e2ccc59b55f0d", "tls_sni": "62.3.50.33", "port": 1200, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:1200 \u00b7 (sonde \/ probe)", "evidence_snippet": "_[*}\ufffd\ufffdm\ufffd\u02bc\ufffd+M?\ufffd?\ufffd\u0141\ufffd\u06ba?\ufffd\ufffd\u02e2\ufffdo\ufffd \ufffd\"\ufffd^\ufffdM3\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd3\ufffdC\u037b\ufffd\ufffd\ufffd\n\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "target_port_label": "1200 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "1200" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ] }
12/10/2026 16:59:22 UTC	TCP	21292 · TLS	tls	Sonde TLS tls probe · via TLS:21292 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole JA3 cd350275e54f0c0d Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 21292 Chemin / cible — Service TLS Payload ��\| .2_m� �)�M,��7~��{�Հ'� ��=i�u��^�ϡ��.E��#>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��\|.2_m��)�M,��7~��{�Հ'� ��=i�u��^�ϡ��.E��#>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Requête brute (extrait) ��\| .2_m� �)�M,��7~��{�Հ'� ��=i�u��^�ϡ��.E��#>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3��=<5/�u # ( +- Meta JSON brut { "tls_ja3_hash": "cd350275e54f0c0d6df9f3c93af0211d", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 8, "bytes_in": 517, "payload_entropy": 3.9532881514705704, "port_category": "registered", "org": "ONYPHE SAS", "service": "tls", "app_proto": "tls", "asn": 213412, "country": "FR", "dst_port": 21292, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 5.2, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "296b764dd78511867387b137ecf92f312a243a7b", "event_fingerprint": "f268386f0b1faf2d959cb73339e7b0713775812a", "classification_confidence": 0.6, "confidence": 0.6, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35, "correlation_boost": 10 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 213412, "org": "ONYPHE SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cd350275e54f0c0d6df9f3c93af0211d", "payload_hash": "5b608fd8da9461ce56b7aa51ae358a22", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 21292, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0011\|\u0002\u000b.2_m\ufffd\u000b\ufffd)\ufffdM,\ufffd\ufffd7~\ufffd\ufffd\ufffd{\ufffd\u0540'\ufffd \ufffd\ufffd=\u001e\u0014i\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\u03e1\ufffd\u001d\ufffd\ufffd.E\ufffd\ufffd\u0018\ufffd\ufffd\ufffd#\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0011\|\u0002\u000b.2_m\ufffd\u000b\ufffd)\ufffdM,\ufffd\ufffd7~\ufffd\ufffd\ufffd{\ufffd\u0540'\ufffd \ufffd\ufffd=\u001e\u0014i\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\u03e1\ufffd\u001d\ufffd\ufffd.E\ufffd\ufffd\u0018\ufffd\ufffd\ufffd#\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0011\|\u0002\u000b.2_m\ufffd\u000b\ufffd)\ufffdM,\ufffd\ufffd7~\ufffd\ufffd\ufffd{\ufffd\u0540'\ufffd \ufffd\ufffd=\u001e\u0014i\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\u03e1\ufffd\u001d\ufffd\ufffd.E\ufffd\ufffd\u0018\ufffd\ufffd\ufffd#\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "1de6938f57aa9b580553d411a8ee792d67817a44", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0011\|\u0002\u000b.2_m\ufffd\u000b\ufffd)\ufffdM,\ufffd\ufffd7~\ufffd\ufffd\ufffd{\ufffd\u0540'\ufffd \ufffd\ufffd=\u001e\u0014i\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\u03e1\ufffd\u001d\ufffd\ufffd.E\ufffd\ufffd\u0018\ufffd\ufffd\ufffd#\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "tls_ja3": "cd350275e54f0c0d6df9f3c93af0211d", "port": 21292, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\|.2_m\ufffd\ufffd)\ufffdM,\ufffd\ufffd7~\ufffd\ufffd\ufffd{\ufffd\u0540'\ufffd \ufffd\ufffd=i\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\u03e1\ufffd\ufffd\ufffd.E\ufffd\ufffd\ufffd\ufffd\ufffd#>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd", "attack_vector": "tls probe \u00b7 via TLS:21292 \u00b7 (sonde \/ probe)", "target_port_label": "21292 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 21292, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd\ufffd\ufffd\ufffd\u0011\|\u0002\u000b.2_m\ufffd\u000b\ufffd)\ufffdM,\ufffd\ufffd7~\ufffd\ufffd\ufffd{\ufffd\u0540'\ufffd \ufffd\ufffd=\u001e\u0014i\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\u03e1\ufffd\u001d\ufffd\ufffd.E\ufffd\ufffd\u0018\ufffd\ufffd\ufffd#\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "tls_ja3": "cd350275e54f0c0d6df9f3c93af0211d", "port": 21292, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:21292 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\|.2_m\ufffd\ufffd)\ufffdM,\ufffd\ufffd7~\ufffd\ufffd\ufffd{\ufffd\u0540'\ufffd \ufffd\ufffd=i\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd^\ufffd\u03e1\ufffd\ufffd\ufffd.E\ufffd\ufffd\ufffd\ufffd\ufffd#>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd", "target_port_label": "21292 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (91.231.89.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "21292" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "91.231.89.0\/24", "coordinated_ip_count": 4, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
12/10/2026 16:18:58 UTC	TCP	2910 · TLS	tls	Sonde TLS tls probe · via TLS:2910 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole JA3 cd350275e54f0c0d Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2910 Chemin / cible — Service TLS Payload ��;��N7HBW��M4Y�Iߒ(�ҏR �� Ws��֑U��k��R��9��ִ3�P/�>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��;��N7HBW��M4Y�Iߒ(�ҏR�� Ws��֑U��k��R��9��ִ3�P/�>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Requête brute (extrait) ��;��N7HBW��M4Y�Iߒ(�ҏR �� Ws��֑U��k��R��9��ִ3�P/�>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3��=<5/�u # ( +- Meta JSON brut { "tls_ja3_hash": "cd350275e54f0c0d6df9f3c93af0211d", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 8, "bytes_in": 517, "payload_entropy": 3.96646029837671, "port_category": "registered", "org": "ONYPHE SAS", "service": "tls", "app_proto": "tls", "asn": 213412, "country": "FR", "dst_port": 2910, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 5.4, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "905230b2027b8693c4b0ae4251147c7dbd23bcc4", "event_fingerprint": "fefbef34d4d89eb976b3c5f616fd4b6177c46c1e", "classification_confidence": 0.6, "confidence": 0.6, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35, "correlation_boost": 10 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 213412, "org": "ONYPHE SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cd350275e54f0c0d6df9f3c93af0211d", "payload_hash": "d31ec3637ebd7c8866887335bac73c85", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 2910, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd;\ufffd\ufffdN7HBW\ufffd\ufffd\ufffd\ufffdM\u00024\u0014Y\ufffdI\u07d2\u0015(\ufffd\u048fR\f\ufffd\ufffd \ufffd\u001d\ufffdWs\ufffd\ufffd\ufffd\u0591U\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffdR\ufffd\ufffd9\ufffd\ufffd\ufffd\u05b43\ufffdP\/\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd;\ufffd\ufffdN7HBW\ufffd\ufffd\ufffd\ufffdM\u00024\u0014Y\ufffdI\u07d2\u0015(\ufffd\u048fR\f\ufffd\ufffd \ufffd\u001d\ufffdWs\ufffd\ufffd\ufffd\u0591U\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffdR\ufffd\ufffd9\ufffd\ufffd\ufffd\u05b43\ufffdP\/\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd;\ufffd\ufffdN7HBW\ufffd\ufffd\ufffd\ufffdM\u00024\u0014Y\ufffdI\u07d2\u0015(\ufffd\u048fR\f\ufffd\ufffd \ufffd\u001d\ufffdWs\ufffd\ufffd\ufffd\u0591U\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffdR\ufffd\ufffd9\ufffd\ufffd\ufffd\u05b43\ufffdP\/\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "5595e28e2d26e2b83a137e995e3b78417bfdd1a9", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd;\ufffd\ufffdN7HBW\ufffd\ufffd\ufffd\ufffdM\u00024\u0014Y\ufffdI\u07d2\u0015(\ufffd\u048fR\f\ufffd\ufffd \ufffd\u001d\ufffdWs\ufffd\ufffd\ufffd\u0591U\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffdR\ufffd\ufffd9\ufffd\ufffd\ufffd\u05b43\ufffdP\/\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "tls_ja3": "cd350275e54f0c0d6df9f3c93af0211d", "port": 2910, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd\ufffd;\ufffd\ufffdN7HBW\ufffd\ufffd\ufffd\ufffdM4Y\ufffdI\u07d2(\ufffd\u048fR\ufffd\ufffd \ufffd\ufffdWs\ufffd\ufffd\ufffd\u0591U\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffdR\ufffd\ufffd9\ufffd\ufffd\ufffd\u05b43\ufffdP\/\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd", "attack_vector": "tls probe \u00b7 via TLS:2910 \u00b7 (sonde \/ probe)", "target_port_label": "2910 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2910, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003\ufffd;\ufffd\ufffdN7HBW\ufffd\ufffd\ufffd\ufffdM\u00024\u0014Y\ufffdI\u07d2\u0015(\ufffd\u048fR\f\ufffd\ufffd \ufffd\u001d\ufffdWs\ufffd\ufffd\ufffd\u0591U\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffdR\ufffd\ufffd9\ufffd\ufffd\ufffd\u05b43\ufffdP\/\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "tls_ja3": "cd350275e54f0c0d6df9f3c93af0211d", "port": 2910, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2910 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd;\ufffd\ufffdN7HBW\ufffd\ufffd\ufffd\ufffdM4Y\ufffdI\u07d2(\ufffd\u048fR\ufffd\ufffd \ufffd\ufffdWs\ufffd\ufffd\ufffd\u0591U\ufffd\ufffd\ufffdk\ufffd\ufffd\ufffdR\ufffd\ufffd9\ufffd\ufffd\ufffd\u05b43\ufffdP\/\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd", "target_port_label": "2910 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (91.231.89.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2910" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "91.231.89.0\/24", "coordinated_ip_count": 4, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
12/10/2026 15:51:23 UTC	TCP	21266 · TLS	tls	Sonde TLS tls probe · via TLS:21266 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole JA3 4ab40ed46d2f0f15 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 21266 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload _[��wO��g��>�J�i��'�=�� }Vn,Ӻq�ʬ#��˩��G#O�o��p��~�3g��9k��E�� #��+� �$�� Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) _[��wO��g��>�J�i��'�=�� }Vn,Ӻq�ʬ#��˩��G#O�o��p��~�3g��9k��E�� #��+� �$�� Requête brute (extrait) _[��wO��g��>�J�i��'�=�� }Vn,Ӻq�ʬ#��˩��G#O�o��p��~�3g��9k��E�� #��+� �$��,�r�s̩��'�/��(�0�`�a�v�w̨�� /<��5=��A�� 62.3.50.33 Meta JSON brut { "tls_ja3_hash": "4ab40ed46d2f0f15292e2ccc59b55f0d", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 20, "bytes_in": 612, "payload_entropy": 4.329467382297863, "port_category": "registered", "org": "ONYPHE SAS", "service": "tls", "app_proto": "tls", "asn": 213412, "country": "FR", "dst_port": 21266, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 1, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "cddf2c067058625f0688bc657951d79786844376", "event_fingerprint": "202e8c4466acaabd9ed23843a65dc3989fe1fceb", "classification_confidence": 0.6, "confidence": 0.6, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35, "correlation_boost": 10 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 213412, "org": "ONYPHE SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "4ab40ed46d2f0f15292e2ccc59b55f0d", "payload_hash": "e4367e682b2592b0e9b0d20b53f7d36b", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 21266, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\ufffd\ufffd\ufffdwO\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd>\ufffdJ\ufffdi\ufffd\ufffd'\ufffd=\ufffd\ufffd\ufffd\ufffd }Vn,\u04faq\ufffd\u02ac#\ufffd\u0001\ufffd\ufffd\u02e9\ufffd\ufffd\u000fG#O\ufffdo\ufffd\ufffdp\ufffd\ufffd~\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\ufffd\ufffd\ufffdwO\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd>\ufffdJ\ufffdi\ufffd\ufffd'\ufffd=\ufffd\ufffd\ufffd\ufffd }Vn,\u04faq\ufffd\u02ac#\ufffd\u0001\ufffd\ufffd\u02e9\ufffd\ufffd\u000fG#O\ufffdo\ufffd\ufffdp\ufffd\ufffd~\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0001\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000", "payload_snippet": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\ufffd\ufffd\ufffdwO\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd>\ufffdJ\ufffdi\ufffd\ufffd'\ufffd=\ufffd\ufffd\ufffd\ufffd }Vn,\u04faq\ufffd\u02ac#\ufffd\u0001\ufffd\ufffd\u02e9\ufffd\ufffd\u000fG#O\ufffdo\ufffd\ufffdp\ufffd\ufffd~\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "99b10e0ef704c92752376a1df7797fede63132b8", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\ufffd\ufffd\ufffdwO\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd>\ufffdJ\ufffdi\ufffd\ufffd'\ufffd=\ufffd\ufffd\ufffd\ufffd }Vn,\u04faq\ufffd\u02ac#\ufffd\u0001\ufffd\ufffd\u02e9\ufffd\ufffd\u000fG#O\ufffdo\ufffd\ufffdp\ufffd\ufffd~\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "4ab40ed46d2f0f15292e2ccc59b55f0d", "tls_sni": "62.3.50.33", "port": 21266, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "_[\ufffd\ufffd\ufffdwO\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd>\ufffdJ\ufffdi\ufffd\ufffd'\ufffd=\ufffd\ufffd\ufffd\ufffd }Vn,\u04faq\ufffd\u02ac#\ufffd\ufffd\ufffd\u02e9\ufffd\ufffdG#O\ufffdo\ufffd\ufffdp\ufffd\ufffd~\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "attack_vector": "tls probe \u00b7 via TLS:21266 \u00b7 (sonde \/ probe)", "target_port_label": "21266 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 21266, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\ufffd\ufffd\ufffdwO\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd>\ufffdJ\ufffdi\ufffd\ufffd'\ufffd=\ufffd\ufffd\ufffd\ufffd }Vn,\u04faq\ufffd\u02ac#\ufffd\u0001\ufffd\ufffd\u02e9\ufffd\ufffd\u000fG#O\ufffdo\ufffd\ufffdp\ufffd\ufffd~\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "4ab40ed46d2f0f15292e2ccc59b55f0d", "tls_sni": "62.3.50.33", "port": 21266, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:21266 \u00b7 (sonde \/ probe)", "evidence_snippet": "_[\ufffd\ufffd\ufffdwO\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd>\ufffdJ\ufffdi\ufffd\ufffd'\ufffd=\ufffd\ufffd\ufffd\ufffd }Vn,\u04faq\ufffd\u02ac#\ufffd\ufffd\ufffd\u02e9\ufffd\ufffdG#O\ufffdo\ufffd\ufffdp\ufffd\ufffd~\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "target_port_label": "21266 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (91.231.89.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "21266" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "91.231.89.0\/24", "coordinated_ip_count": 3, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ] }
12/10/2026 13:04:20 UTC	TCP	21101 · TLS	tls	Sonde TLS tls probe · via TLS:21101 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 4ab40ed46d2f0f15 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 21101 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload _[ �7��Me�7Û�"t<��:�� 3 @��2k;��{��,?��2#n��ا/�3g��9k��E�� #��+� �$�� Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) _[ �7��Me�7Û�"t<��:��3 @��2k;��{��,?��2#n��ا/�3g��9k��E�� #��+� �$�� Requête brute (extrait) _[ �7��Me�7Û�"t<��:�� 3 @��2k;��{��,?��2#n��ا/�3g��9k��E�� #��+� �$��,�r�s̩��'�/��(�0�`�a�v�w̨�� /<��5=��A�� 62.3.50.33 Meta JSON brut { "tls_ja3_hash": "4ab40ed46d2f0f15292e2ccc59b55f0d", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 20, "bytes_in": 612, "payload_entropy": 4.347499616805759, "port_category": "registered", "org": "ONYPHE SAS", "service": "tls", "app_proto": "tls", "asn": 213412, "country": "FR", "dst_port": 21101, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 4.4, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "61bed13260a1953b2a1a6b97b63aa2768eb8fc53", "event_fingerprint": "17a951e737bb8504709f78a8d6cde1a47de74cdf", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 213412, "org": "ONYPHE SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "4ab40ed46d2f0f15292e2ccc59b55f0d", "payload_hash": "77c2f2ffb65de362b8344e9d1d27a025", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 21101, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\r\u000b\ufffd7\u0007\ufffd\ufffdMe\ufffd7\u00db\ufffd\"t<\ufffd\u001f\ufffd:\u000e\ufffd\ufffd\ufffd\ufffd\f\ufffd3 @\ufffd\ufffd\ufffd\u00102\u0017k;\ufffd\ufffd\ufffd{\ufffd\ufffd\ufffd,?\ufffd\ufffd\ufffd\ufffd2#n\ufffd\ufffd\u001a\u0627\/\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\r\u000b\ufffd7\u0007\ufffd\ufffdMe\ufffd7\u00db\ufffd\"t<\ufffd\u001f\ufffd:\u000e\ufffd\ufffd\ufffd\ufffd\f\ufffd3 @\ufffd\ufffd\ufffd\u00102\u0017k;\ufffd\ufffd\ufffd{\ufffd\ufffd\ufffd,?\ufffd\ufffd\ufffd\ufffd2#n\ufffd\ufffd\u001a\u0627\/\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0001\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000", "payload_snippet": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\r\u000b\ufffd7\u0007\ufffd\ufffdMe\ufffd7\u00db\ufffd\"t<\ufffd\u001f\ufffd:\u000e\ufffd\ufffd\ufffd\ufffd\f\ufffd3 @\ufffd\ufffd\ufffd\u00102\u0017k;\ufffd\ufffd\ufffd{\ufffd\ufffd\ufffd,?\ufffd\ufffd\ufffd\ufffd2#n\ufffd\ufffd\u001a\u0627\/\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fd0ef982659ce091f650f35ecf6777524159dfd7", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\r\u000b\ufffd7\u0007\ufffd\ufffdMe\ufffd7\u00db\ufffd\"t<\ufffd\u001f\ufffd:\u000e\ufffd\ufffd\ufffd\ufffd\f\ufffd3 @\ufffd\ufffd\ufffd\u00102\u0017k;\ufffd\ufffd\ufffd{\ufffd\ufffd\ufffd,?\ufffd\ufffd\ufffd\ufffd2#n\ufffd\ufffd\u001a\u0627\/\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "4ab40ed46d2f0f15292e2ccc59b55f0d", "tls_sni": "62.3.50.33", "port": 21101, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "_[\r\ufffd7\ufffd\ufffdMe\ufffd7\u00db\ufffd\"t<\ufffd\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd3 @\ufffd\ufffd\ufffd2k;\ufffd\ufffd\ufffd{\ufffd\ufffd\ufffd,?\ufffd\ufffd\ufffd\ufffd2#n\ufffd\ufffd\u0627\/\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "attack_vector": "tls probe \u00b7 via TLS:21101 \u00b7 (sonde \/ probe)", "target_port_label": "21101 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 21101, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\r\u000b\ufffd7\u0007\ufffd\ufffdMe\ufffd7\u00db\ufffd\"t<\ufffd\u001f\ufffd:\u000e\ufffd\ufffd\ufffd\ufffd\f\ufffd3 @\ufffd\ufffd\ufffd\u00102\u0017k;\ufffd\ufffd\ufffd{\ufffd\ufffd\ufffd,?\ufffd\ufffd\ufffd\ufffd2#n\ufffd\ufffd\u001a\u0627\/\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "4ab40ed46d2f0f15292e2ccc59b55f0d", "tls_sni": "62.3.50.33", "port": 21101, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:21101 \u00b7 (sonde \/ probe)", "evidence_snippet": "_[\r\ufffd7\ufffd\ufffdMe\ufffd7\u00db\ufffd\"t<\ufffd\ufffd:\ufffd\ufffd\ufffd\ufffd\ufffd3 @\ufffd\ufffd\ufffd*2k;\ufffd\ufffd\ufffd{\ufffd\ufffd\ufffd,?\ufffd\ufffd\ufffd\ufffd2#n\ufffd\ufffd\u0627\/\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "target_port_label": "21101 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "21101" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ] }
12/10/2026 12:39:14 UTC	TCP	12002	—	Sonde port 12002 Sonde port · port 12002 · (sonde / probe)	Faible	Moyen · 44
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole WAF — Recommandation Surveiller Tags — Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 12002 Chemin / cible — Pourquoi cette classification : Type « port_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 44 Confiance : Confiance modérée (50 %) — signal principal unique Signaux Fp Port Probe Noise Single Port Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Meta JSON brut { "bytes_in": 0, "payload_entropy": 0, "port_category": "registered", "org": "ONYPHE SAS", "service": null, "app_proto": null, "asn": 213412, "country": "FR", "dst_port": 12002, "risk_waf": 8, "risk_classification": 48, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 0, "risk_novelty": 0, "risk_boost": 0, "risk_granularity": 0.8, "risk_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0 }, "risk_score": 44, "tag_count": 0, "anomaly_count": 0, "campaign_key": "ffe45687959c2c9787dd7ea540cca115edb91fc4", "event_fingerprint": "d859047959f61f593342dd67d2ea501765f989f5", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "INT-FP-port-probe-noise", "INT-single-port" ], "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 213412, "org": "ONYPHE SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d" }, "target_context": { "dst_port": 12002, "risk_score": 44 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f1a73eacb391d0dfeca959c499c640ea9a9fc0c2", "protocol_details": { "port": 12002 }, "attack_vector": "Sonde port \u00b7 port 12002 \u00b7 (sonde \/ probe)", "target_port_label": "12002", "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "site_display": { "classification": null, "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 48, "behavior": 0, "geo": 0, "protocol": 0, "novelty": 0, "risk_score": 44 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 44, "risk_label": "Moyen", "service_name": null, "service_label_fr": null, "dst_port": 12002, "protocol_emulated": null, "tags_summary": [ "INT-FP-port-probe-noise", "INT-single-port" ], "tags_summary_labels_fr": [ "Fp Port Probe Noise", "Single Port" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "port": 12002 }, "attack_vector": "Sonde port \u00b7 port 12002 \u00b7 (sonde \/ probe)", "evidence_snippet": null, "target_port_label": "12002", "emulator_service": null, "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "generic", "service_banner": "honeypot", "service_os": "linux", "dst_port": "12002" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor" }
12/10/2026 11:55:29 UTC	TCP	2123 · TLS	tls	Sonde TLS tls probe · via TLS:2123 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné MITRE TA0007 TA0007 TA0001 Protocole JA3 cd350275e54f0c0d Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2123 Chemin / cible — Service TLS Payload �6��B\ ��Q�2D,x"��XZn�u� ��ќ��ϗ��<�+��o�ز�N+8��>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 60% Corrélation +10 Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �6��B\ ��Q�2D,x"��XZn�u� ��ќ��ϗ��<�+��o�ز�N+8��>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Requête brute (extrait) �6��B\ ��Q�2D,x"��XZn�u� ��ќ��ϗ��<�+��o�ز�N+8��>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3��=<5/�u # ( +- Meta JSON brut { "tls_ja3_hash": "cd350275e54f0c0d6df9f3c93af0211d", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 8, "bytes_in": 517, "payload_entropy": 3.9578563990797413, "port_category": "registered", "org": "ONYPHE SAS", "service": "tls", "app_proto": "tls", "asn": 213412, "country": "FR", "dst_port": 2123, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 3.4, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "f4b171ea6f813c346ac579f81de15917cc99033f", "event_fingerprint": "a553a5880318c146d0d443b97bc3d13e4bbf700b", "classification_confidence": 0.6, "confidence": 0.6, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35, "correlation_boost": 10 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 213412, "org": "ONYPHE SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cd350275e54f0c0d6df9f3c93af0211d", "payload_hash": "9a15c7c7d7efb71b92067c224d116db3", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 2123, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\ufffdB\\\n\ufffd\u001e\ufffdQ\u0004\ufffd\u00132D,x\u001b\"\ufffd\ufffd\u0004\ufffd\ufffdXZn\ufffdu\ufffd \u0015\ufffd\ufffd\u045c\ufffd\ufffd\u03d7\u0013\ufffd\ufffd<\ufffd+\ufffd\ufffdo\ufffd\u0632\ufffdN\u0016+8\u000e\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\ufffdB\\\n\ufffd\u001e\ufffdQ\u0004\ufffd\u00132D,x\u001b\"\ufffd\ufffd\u0004\ufffd\ufffdXZn\ufffdu\ufffd \u0015\ufffd\ufffd\u045c\ufffd\ufffd\u03d7\u0013\ufffd\ufffd<\ufffd+\ufffd\ufffdo\ufffd\u0632\ufffdN\u0016+8\u000e\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\ufffdB\\\n\ufffd\u001e\ufffdQ\u0004\ufffd\u00132D,x\u001b\"\ufffd\ufffd\u0004\ufffd\ufffdXZn\ufffdu\ufffd \u0015\ufffd\ufffd\u045c\ufffd\ufffd\u03d7\u0013\ufffd\ufffd<\ufffd+\ufffd\ufffdo\ufffd\u0632\ufffdN\u0016+8\u000e\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "87b96894152bdbfea1d22572d3d391a82840233c", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\ufffdB\\\n\ufffd\u001e\ufffdQ\u0004\ufffd\u00132D,x\u001b\"\ufffd\ufffd\u0004\ufffd\ufffdXZn\ufffdu\ufffd \u0015\ufffd\ufffd\u045c\ufffd\ufffd\u03d7\u0013\ufffd\ufffd<\ufffd+\ufffd\ufffdo\ufffd\u0632\ufffdN\u0016+8\u000e\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "tls_ja3": "cd350275e54f0c0d6df9f3c93af0211d", "port": 2123, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffd6\ufffd\ufffdB\\\n\ufffd\ufffdQ\ufffd2D,x\"\ufffd\ufffd\ufffd\ufffdXZn\ufffdu\ufffd \ufffd\ufffd\u045c\ufffd\ufffd\u03d7\ufffd\ufffd<\ufffd+\ufffd\ufffdo\ufffd\u0632\ufffdN+8\ufffd\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd", "attack_vector": "tls probe \u00b7 via TLS:2123 \u00b7 (sonde \/ probe)", "target_port_label": "2123 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 60, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35, "correlation_boost": 10 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "reconnaissance", "attack_chain_stage_label_fr": "Reconnaissance", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2123, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": [ "scan_coordonn\u00e9" ], "correlation_flags_labels_fr": [ "Scan coordonn\u00e9" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +10", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u00036\ufffd\ufffdB\\\n\ufffd\u001e\ufffdQ\u0004\ufffd\u00132D,x\u001b\"\ufffd\ufffd\u0004\ufffd\ufffdXZn\ufffdu\ufffd \u0015\ufffd\ufffd\u045c\ufffd\ufffd\u03d7\u0013\ufffd\ufffd<\ufffd+\ufffd\ufffdo\ufffd\u0632\ufffdN\u0016+8\u000e\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "tls_ja3": "cd350275e54f0c0d6df9f3c93af0211d", "port": 2123, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2123 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd6\ufffd\ufffdB\\\n\ufffd\ufffdQ\ufffd2D,x\"\ufffd\ufffd\ufffd\ufffdXZn\ufffdu\ufffd \ufffd\ufffd\u045c\ufffd\ufffd\u03d7\ufffd\ufffd<\ufffd+\ufffd\ufffdo\ufffd\u0632\ufffdN+8*\ufffd\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd", "target_port_label": "2123 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10", "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (91.231.89.0\/24, \u22653 pairs)", "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "reconnaissance", "label_fr": "Reconnaissance", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2123" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "coordinated_scan": true, "coordinated_subnet": "91.231.89.0\/24", "coordinated_ip_count": 4, "behavior_alerts": [ "coordinated_scan" ], "correlation_confidence_boost": 10, "attack_chain_stage": "reconnaissance", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
12/10/2026 11:10:42 UTC	TCP	20443 · HTTPS ALT 20443	https-alt-20443	Cross-site scripting xss attack · via HTTPS ALT 20443:20443 · (tentative d'exploit)	Élevée	Moyen · 44
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole Émulateur HTTPS-ALT-20443 WAF — Recommandation Surveiller Tags http_get_probe mozi_pattern net_mozi_pattern Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 20443 Chemin / cible — Service HTTPS ALT 20443 Payload GET / HTTP/1.1 Host: 62.3.50.33:20443 Connection: close User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/2 Pourquoi cette classification : Type « xss_attack » (signaux protocolaires) · confiance 59% Confiance classification 59% Risque capteur Moyen · 44 Confiance : Confiance 59 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0284 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 941130 User-Agent — Règles WAF — Payload (extrait) GET / HTTP/1.1 Host: 62.3.50.33:20443 Connection: close User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/2 Requête brute (extrait) GET / HTTP/1.1 Host: 62.3.50.33:20443 Connection: close User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "bytes_in": 259, "payload_entropy": 5.430953806841181, "port_category": "registered", "org": "ONYPHE SAS", "service": "https-alt-20443", "app_proto": "https-alt-20443", "asn": 213412, "country": "FR", "dst_port": 20443, "risk_waf": 8, "risk_classification": 68, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 40, "risk_novelty": 15, "risk_boost": 20, "risk_granularity": 3.3, "risk_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15 }, "risk_score": 44, "tag_count": 3, "anomaly_count": 0, "campaign_key": "f86c653a87eab2939537d2bd2197da5a5f2e72dc", "event_fingerprint": "a1f3f85f3d155d1f7906171f8478ea55c2ac3df2", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "confidence": 0.59, "classification_confidence": 0.59, "precision_score": 70, "precision_signals": [ "pat-0284" ], "kb_rule_ids": [ "pat-0284" ], "matched_patterns": [ "pat-0284" ], "matched_pattern_names": [ "CRS 941130" ], "pattern_ids": [ "pat-0284" ], "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 44 }, "named_classification_skipped": false, "service_name": "https-alt-20443", "risk_confidence_factor": 59, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 213412, "org": "ONYPHE SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "018140885ea04d02a2e17efa2d95eb29", "path_pattern_hash": "e84c630ed8a3a6084c1b662f626e7300" }, "target_context": { "dst_port": 20443, "service": "https-alt-20443", "service_name": "https-alt-20443", "risk_score": 44 }, "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:20443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko\/2", "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:20443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,\/;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:20443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko\/2", "evidence": { "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:20443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko\/20100101 Firefox\/134.0\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,\/;q=0.8\r\nAccept-Language: en-US,en;q=0.5\r", "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:20443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko\/2", "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "35418d885339e58aebb70d38a293c83205ed7b09", "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:20443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko\/2", "port": 20443, "service": "https-alt-20443", "service_label_fr": "HTTPS ALT 20443" }, "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:20443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko\/2", "attack_vector": "xss attack \u00b7 via HTTPS ALT 20443:20443 \u00b7 (tentative d'exploit)", "target_port_label": "20443 \u00b7 HTTPS ALT 20443", "emulator_service": "https-alt-20443", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTPS ALT 20443", "confidence_pct": 59, "confidence_breakdown": { "waf": 8, "classification": 68, "behavior": 0, "geo": 0, "protocol": 40, "novelty": 15, "risk_score": 44 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 44, "risk_label": "Moyen", "service_name": "https-alt-20443", "service_label_fr": "HTTPS ALT 20443", "dst_port": 20443, "protocol_emulated": true, "tags_summary": [ "pat-0284" ], "tags_summary_labels_fr": [ "pat-0284" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-https-alt-20443", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:20443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko\/2", "port": 20443, "service": "https-alt-20443", "service_label_fr": "HTTPS ALT 20443" }, "attack_vector": "xss attack \u00b7 via HTTPS ALT 20443:20443 \u00b7 (tentative d'exploit)", "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:20443\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko\/2", "target_port_label": "20443 \u00b7 HTTPS ALT 20443", "emulator_service": "https-alt-20443", "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "https_alt_20443", "service_banner": "honeypot-https-alt-20443", "service_os": "linux", "dst_port": "20443" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_monitor", "tags_list": [ "http_get_probe", "mozi_pattern", "net_mozi_pattern" ] }
12/10/2026 09:57:10 UTC	TCP	20205 · TLS	tls	Sonde TLS tls probe · via TLS:20205 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 4ab40ed46d2f0f15 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 20205 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload _[��Z�g/��h��1�>�9> ��P w�'��39j�� fF��6�0��3g��9k��E�� #��+� �$�� Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) _[��Z�g/��h��1�>�9> ��P w�'��39j�� fF��6�0��3g��9k��E�� #��+� �$�� Requête brute (extrait) _[��Z�g/��h��1�>�9> ��P w�'��39j�� fF��6�0��3g��9k��E�� #��+� �$��,�r�s̩��'�/��(�0�`�a�v�w̨�� /<��5=��A�� 62.3.50.33 Meta JSON brut { "tls_ja3_hash": "4ab40ed46d2f0f15292e2ccc59b55f0d", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 20, "bytes_in": 612, "payload_entropy": 4.311483531871172, "port_category": "registered", "org": "ONYPHE SAS", "service": "tls", "app_proto": "tls", "asn": 213412, "country": "FR", "dst_port": 20205, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 4.9, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "6980a8fd2019994c7d3e2c94d48493adf5cb1125", "event_fingerprint": "e43fdfbc055fb3c8ca479d23b1e7176a998686f1", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 213412, "org": "ONYPHE SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "4ab40ed46d2f0f15292e2ccc59b55f0d", "payload_hash": "09ceefd5948b1118065b2fad4ad9516b", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 20205, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\u0018\ufffd\ufffd\ufffdZ\ufffdg\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd1\u0015\u000e\ufffd>\ufffd9>\n\ufffd\ufffd\ufffd\ufffdP w\ufffd'\ufffd\ufffd39j\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdfF\ufffd\ufffd\ufffd\u00186\ufffd0\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\u0018\ufffd\ufffd\ufffdZ\ufffdg\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd1\u0015\u000e\ufffd>\ufffd9>\n\ufffd\ufffd\ufffd\ufffdP w\ufffd'\ufffd\ufffd39j\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdfF\ufffd\ufffd\ufffd\u00186\ufffd0\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0001\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000", "payload_snippet": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\u0018\ufffd\ufffd\ufffdZ\ufffdg\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd1\u0015\u000e\ufffd>\ufffd9>\n\ufffd\ufffd\ufffd\ufffdP w\ufffd'\ufffd\ufffd39j\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdfF\ufffd\ufffd\ufffd\u00186\ufffd0\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "707daa49c652f2aaaa995f35d865926fbf117e96", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\u0018\ufffd\ufffd\ufffdZ\ufffdg\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd1\u0015\u000e\ufffd>\ufffd9>\n\ufffd\ufffd\ufffd\ufffdP w\ufffd'\ufffd\ufffd39j\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdfF\ufffd\ufffd\ufffd\u00186\ufffd0\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "4ab40ed46d2f0f15292e2ccc59b55f0d", "tls_sni": "62.3.50.33", "port": 20205, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "_[\ufffd\ufffd\ufffdZ\ufffdg\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd1\ufffd>\ufffd9>\n\ufffd\ufffd\ufffd\ufffdP w\ufffd'\ufffd\ufffd39j\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdfF\ufffd\ufffd\ufffd6\ufffd0\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "attack_vector": "tls probe \u00b7 via TLS:20205 \u00b7 (sonde \/ probe)", "target_port_label": "20205 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 20205, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\u0018\ufffd\ufffd\ufffdZ\ufffdg\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd1\u0015\u000e\ufffd>\ufffd9>\n\ufffd\ufffd\ufffd\ufffdP w\ufffd'\ufffd\ufffd39j\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdfF\ufffd\ufffd\ufffd\u00186\ufffd0\ufffd\ufffd\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "4ab40ed46d2f0f15292e2ccc59b55f0d", "tls_sni": "62.3.50.33", "port": 20205, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:20205 \u00b7 (sonde \/ probe)", "evidence_snippet": "_[\ufffd\ufffd\ufffdZ\ufffdg\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdh\ufffd\ufffd1\ufffd>\ufffd9>\n\ufffd\ufffd\ufffd\ufffdP w\ufffd'\ufffd\ufffd39j\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \ufffd\ufffd\ufffdfF\ufffd\ufffd\ufffd6\ufffd0\ufffd\ufffd\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "target_port_label": "20205 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "20205" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ], "behavior_alert_count": 1, "behavior_priority": 72 }
12/10/2026 08:36:25 UTC	TCP	2800 · TLS	tls	Sonde TLS tls probe · via TLS:2800 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 cd350275e54f0c0d Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2800 Chemin / cible — Service TLS Payload �G1͕?ً#B��x=��:��ȑ� �$�{�e ��e�ٷ��2��,�p}�R�!��"�pbV��>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Pourquoi cette classification : Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �G1͕?ً#B��x=��:��ȑ� �$�{�e ��e�ٷ��2��,�p}�R�!��"�pbV��>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3� Requête brute (extrait) �G1͕?ً#B��x=��:��ȑ� �$�{�e ��e�ٷ��2��,�p}�R�!��"�pbV��>�,�0�̨̩̪�+�/��$�(k�#�'g� �9� �3��=<5/�u # ( +- Meta JSON brut { "tls_ja3_hash": "cd350275e54f0c0d6df9f3c93af0211d", "tls_sni": null, "tls_weak_cipher": true, "tls_weak_cipher_count": 8, "bytes_in": 517, "payload_entropy": 4.007604624590379, "port_category": "registered", "org": "ONYPHE SAS", "service": "tls", "app_proto": "tls", "asn": 213412, "country": "FR", "dst_port": 2800, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "6d28a754a8e2c53fccddbba4feb4cec03dc5c24f", "event_fingerprint": "8693b97cefa67099fa9fca8813dd0fe04a550674", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 213412, "org": "ONYPHE SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "cd350275e54f0c0d6df9f3c93af0211d", "payload_hash": "a3a8240ffe0767c34626a9f707d75ce4", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c" }, "target_context": { "dst_port": 2800, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003G1\u0355?\u064b#B\ufffd\ufffd\ufffdx=\ufffd\ufffd:\ufffd\ufffd\u0211\ufffd\t \ufffd$\ufffd{\ufffde \ufffd\ufffd\ufffde\ufffd\u0677\ufffd\ufffd2\ufffd\ufffd\ufffd,\ufffdp}\ufffdR\ufffd!\ufffd\ufffd\"\ufffdpbV\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003G1\u0355?\u064b#B\ufffd\ufffd\ufffdx=\ufffd\ufffd:\ufffd\ufffd\u0211\ufffd\t \ufffd$\ufffd{\ufffde \ufffd\ufffd\ufffde\ufffd\u0677\ufffd\ufffd2\ufffd\ufffd\ufffd,\ufffdp}\ufffdR\ufffd!\ufffd\ufffd\"\ufffdpbV\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd\u0000\ufffd\u0000=\u0000<\u00005\u0000\/\u0000\ufffd\u0001\u0000\u0001u\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\u0016\u0000\u0014\u0000\u001d\u0000\u0017\u0000\u001e\u0000\u0019\u0000\u0018\u0001\u0000\u0001\u0001\u0001\u0002\u0001\u0003\u0001\u0004\u0000#\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\u0016\u0000\u0000\u0000\u0017\u0000\u0000\u0000\r\u0000\u0000(\u0004\u0003\u0005\u0003\u0006\u0003\b\u0007\b\b\b\t\b\n\b\u000b\b\u0004\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0003\u0003\u0003\u0001\u0003\u0002\u0004\u0002\u0005\u0002\u0006\u0002\u0000+\u0000\u0005\u0004\u0003\u0004\u0003\u0003\u0000-", "payload_snippet": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003G1\u0355?\u064b#B\ufffd\ufffd\ufffdx=\ufffd\ufffd:\ufffd\ufffd\u0211\ufffd\t \ufffd$\ufffd{\ufffde \ufffd\ufffd\ufffde\ufffd\u0677\ufffd\ufffd2\ufffd\ufffd\ufffd,\ufffdp}\ufffdR\ufffd!\ufffd\ufffd\"\ufffdpbV\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "391d21f7a940a6f97efbec3b3cedac713bda8738", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003G1\u0355?\u064b#B\ufffd\ufffd\ufffdx=\ufffd\ufffd:\ufffd\ufffd\u0211\ufffd\t \ufffd$\ufffd{\ufffde \ufffd\ufffd\ufffde\ufffd\u0677\ufffd\ufffd2\ufffd\ufffd\ufffd,\ufffdp}\ufffdR\ufffd!\ufffd\ufffd\"\ufffdpbV\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "tls_ja3": "cd350275e54f0c0d6df9f3c93af0211d", "port": 2800, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "\ufffdG1\u0355?\u064b#B\ufffd\ufffd\ufffdx=\ufffd\ufffd:\ufffd\ufffd\u0211\ufffd\t \ufffd$\ufffd{\ufffde \ufffd\ufffd\ufffde\ufffd\u0677\ufffd\ufffd2\ufffd\ufffd\ufffd,\ufffdp}\ufffdR\ufffd!\ufffd\ufffd\"\ufffdpbV\ufffd\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd", "attack_vector": "tls probe \u00b7 via TLS:2800 \u00b7 (sonde \/ probe)", "target_port_label": "2800 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2800, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0002\u0000\u0001\u0000\u0001\ufffd\u0003\u0003G1\u0355?\u064b#B\ufffd\ufffd\ufffdx=\ufffd\ufffd:\ufffd\ufffd\u0211\ufffd\t \ufffd$\ufffd{\ufffde \ufffd\ufffd\ufffde\ufffd\u0677\ufffd\ufffd2\ufffd\ufffd\ufffd,\ufffdp}\ufffdR\ufffd!\ufffd\ufffd\"\ufffdpbV\ufffd\ufffd\ufffd\ufffd\u0000>\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\u0000\ufffd\ufffd$\ufffd(\u0000k\ufffd#\ufffd'\u0000g\ufffd\n\ufffd\u0014\u00009\ufffd\t\ufffd\u0013\u00003\u0000\ufffd", "tls_ja3": "cd350275e54f0c0d6df9f3c93af0211d", "port": 2800, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2800 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffdG1\u0355?\u064b#B\ufffd\ufffd\ufffdx=\ufffd\ufffd:\ufffd\ufffd\u0211\ufffd\t \ufffd$\ufffd{\ufffde \ufffd\ufffd\ufffde\ufffd\u0677\ufffd\ufffd2\ufffd\ufffd\ufffd,\ufffdp}\ufffdR\ufffd!\ufffd\ufffd\"\ufffdpbV\ufffd\ufffd\ufffd\ufffd>\ufffd,\ufffd0\ufffd\u0329\u0328\u032a\ufffd+\ufffd\/\ufffd\ufffd$\ufffd(k\ufffd#\ufffd'g\ufffd\n\ufffd9\ufffd\t\ufffd3\ufffd", "target_port_label": "2800 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2800" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_no_sni", "tls_weak_cipher" ] }
12/10/2026 08:36:21 UTC	TCP	2800 · TLS	tls	Sonde TLS tls probe · via TLS:2800 · (sonde / probe)	Élevée	Faible · 35
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole JA3 4ab40ed46d2f0f15 SNI 62.3.50.33 Émulateur TLS WAF — Recommandation Surveiller Tags tls_ja3 tls_sni_ip tls_weak_cipher Cible HTTP — TLS SNI 62.3.50.33 Capteur paris-1
Preuve / Evidence Méthode — Port 2800 Chemin / cible — Service TLS SNI TLS 62.3.50.33 Payload _[�@��#ݚvcA�?�J�D��C�#��Az ��9A߰ �_��.��#&mF��n=:y=�3g��9k��E�� #��+� �$�� Pourquoi cette classification :* Type « tls_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Faible · 35 Confiance : Confiance 50 % — Motif catalogue confirmé Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) _[�@��#ݚvcA�?�J�D��C�#��Az ��9A߰ �_��.��#&mF��n=:y=�3g��9k��E�� #��+� �$�� Requête brute (extrait) _[�@��#ݚvcA�?�J�D��C�#��Az ��9A߰ �_��.��#&mF��n=:y=�3g��9k��E�� #��+� �$��,�r�s̩��'�/��(�0�`�a�v�w̨�� /<��5=��A�� 62.3.50.33 Meta JSON brut { "tls_ja3_hash": "4ab40ed46d2f0f15292e2ccc59b55f0d", "tls_sni": "62.3.50.33", "tls_weak_cipher": true, "tls_weak_cipher_count": 20, "bytes_in": 612, "payload_entropy": 4.281757065826073, "port_category": "registered", "org": "ONYPHE SAS", "service": "tls", "app_proto": "tls", "asn": 213412, "country": "FR", "dst_port": 2800, "risk_waf": 8, "risk_classification": 32, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 0, "risk_boost": 6, "risk_granularity": 2.6, "risk_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0 }, "risk_score": 35, "tag_count": 3, "anomaly_count": 0, "campaign_key": "b0c25456a7be8986a38a6811b9e7ab72949c2928", "event_fingerprint": "ce724e451ddfe291a7423cf7f95139acee4549db", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "service_name": "tls", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "FR", "asn": 213412, "org": "ONYPHE SAS", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "ja3": "4ab40ed46d2f0f15292e2ccc59b55f0d", "payload_hash": "613ca601548586a7dab6ec203eb98c31", "path_pattern_hash": "8792d2cfdc5028123bfb8f159de8656c", "tls_sni": "62.3.50.33" }, "target_context": { "dst_port": 2800, "service": "tls", "service_name": "tls", "risk_score": 35 }, "payload_snippet": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\u0010\ufffd@\ufffd\ufffd\u0006#\u0002\u075avcA\ufffd?\ufffd\u001eJ\ufffdD\ufffd\u0011\ufffdC\ufffd#\ufffd\u0018\ufffdAz \ufffd\ufffd9A\u0001\u07f0\t\ufffd_\ufffd\ufffd.\ufffd\ufffd#&m\u0002\u0000\u0014\u0011F\ufffd\ufffdn=:y=\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "evidence": { "request_sample": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\u0010\ufffd@\ufffd\ufffd\u0006#\u0002\u075avcA\ufffd?\ufffd\u001eJ\ufffdD\ufffd\u0011\ufffdC\ufffd#\ufffd\u0018\ufffdAz \ufffd\ufffd9A\u0001\u07f0\t\ufffd_\ufffd\ufffd.\ufffd\ufffd#&m\u0002\u0000\u0014\u0011F\ufffd\ufffdn=:y=\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffdr\ufffds\u0329\u0013\u0002\u0013\u0001\ufffd\u0014\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\ufffd`\ufffda\ufffdv\ufffdw\u0328\u0013\u0005\u0013\u0004\u0013\u0003\ufffd\u0013\ufffd\u0011\u0000\n\u0000\/\u0000<\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00005\u0000=\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000A\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\u0007\u0000\u0004\u0000\u0005\u0001\u0000\u0001\ufffd\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u000b\u0000\u0004\u0003\u0000\u0001\u0002\u0000\n\u0000\f\u0000\n\u0000\u001d\u0000", "payload_snippet": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\u0010\ufffd@\ufffd\ufffd\u0006#\u0002\u075avcA\ufffd?\ufffd\u001eJ\ufffdD\ufffd\u0011\ufffdC\ufffd#\ufffd\u0018\ufffdAz \ufffd\ufffd9A\u0001\u07f0\t\ufffd_\ufffd\ufffd.\ufffd\ufffd#&m\u0002\u0000\u0014\u0011F\ufffd\ufffdn=:y=\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a2ad3b0719829a63a2bc1fccfccfe3db2c84b589", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\u0010\ufffd@\ufffd\ufffd\u0006#\u0002\u075avcA\ufffd?\ufffd\u001eJ\ufffdD\ufffd\u0011\ufffdC\ufffd#\ufffd\u0018\ufffdAz \ufffd\ufffd9A\u0001\u07f0\t\ufffd_\ufffd\ufffd.\ufffd\ufffd#&m\u0002\u0000\u0014\u0011F\ufffd\ufffdn=:y=\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "4ab40ed46d2f0f15292e2ccc59b55f0d", "tls_sni": "62.3.50.33", "port": 2800, "service": "tls", "service_label_fr": "TLS" }, "evidence_snippet": "_[\ufffd@\ufffd\ufffd#\u075avcA\ufffd?\ufffdJ\ufffdD\ufffd\ufffdC\ufffd#\ufffd\ufffdAz \ufffd\ufffd9A\u07f0\t\ufffd_\ufffd\ufffd.\ufffd\ufffd#&mF\ufffd\ufffdn=:y=\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "attack_vector": "tls probe \u00b7 via TLS:2800 \u00b7 (sonde \/ probe)", "target_port_label": "2800 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab tls_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 32, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 0, "risk_score": 35 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 35, "risk_label": "Faible", "service_name": "tls", "service_label_fr": "TLS", "dst_port": 2800, "protocol_emulated": null, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-tls", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0003\u0002_\u0001\u0000\u0002[\u0003\u0003\u0010\ufffd@\ufffd\ufffd\u0006#\u0002\u075avcA\ufffd?\ufffd\u001eJ\ufffdD\ufffd\u0011\ufffdC\ufffd#\ufffd\u0018\ufffdAz \ufffd\ufffd9A\u0001\u07f0\t\ufffd_\ufffd\ufffd.\ufffd\ufffd#&m\u0002\u0000\u0014\u0011F\ufffd\ufffdn=:y=\u0000\ufffd\u0000\u0016\u00003\u0000g\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u00009\u0000k\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0000E\u0000\ufffd\u0000\ufffd\u0000\ufffd\u0000\ufffd\ufffd\b\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "tls_ja3": "4ab40ed46d2f0f15292e2ccc59b55f0d", "tls_sni": "62.3.50.33", "port": 2800, "service": "tls", "service_label_fr": "TLS" }, "attack_vector": "tls probe \u00b7 via TLS:2800 \u00b7 (sonde \/ probe)", "evidence_snippet": "_[\ufffd@\ufffd\ufffd#\u075avcA\ufffd?\ufffdJ\ufffdD\ufffd\ufffdC\ufffd#\ufffd\ufffdAz \ufffd\ufffd9A\u07f0\t\ufffd_\ufffd\ufffd.\ufffd*\ufffd#&mF\ufffd\ufffdn=:y=\ufffd3g\ufffd\ufffd\ufffd\ufffd\ufffd9k\ufffd\ufffd\ufffd\ufffd\ufffdE\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\t\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\n\ufffd$\ufffd\ufffd", "target_port_label": "2800 \u00b7 TLS", "emulator_service": "tls", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "tls", "service_banner": "honeypot-tls", "service_os": "linux", "dst_port": "2800" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "tls_ja3", "tls_sni_ip", "tls_weak_cipher" ] }

91.231.89.21

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence