Fiche IP

Bulgarie

93.123.109.124

Activité suspecte — risque 42/100 (Moyen) — MITRE T1046 — confiance 100 % — via PERSONAL AGENT — multi-protocole (839 protocoles · 5 min)

Campagne multi-ports détectée sur une fenêtre courte

FAI Techoff Srv Limited Première vue 27/10/2026 08:00 UTC Dernière vue 27/10/2026 09:31 UTC Risque Moyen

Période 2026-10-03 → 2026-11-02

Moyen 55/100

24h 7j 30j 90j

Synthèse

Score de risque max. 55/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 27/10/2026 08:00 UTC

Dernière observation 27/10/2026 09:31 UTC

Événements (période) 1,799

Décision conseillée Surveiller Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal T1046 1734 occurrences

Pourquoi listée

Type « Scan de ports » (signaux protocolaires) · confiance 100%

Confiance 100 % — Score WAF 8 · Bonus corrélation +23

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

55/100 Confiance 100 % 1,799 événements T1046

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 93.123.109.124
Décision : Investiguer
Score max : 55/100 (Moyen)
Confiance : 100 %
Période : 2026-10-03 → 2026-11-02 · 1799 événements
Motif : Type « Scan de ports » (signaux protocolaires) · confiance 100%
MITRE : T1046
FAI : Techoff Srv Limited · Bulgarie

Comparaison ASN / FAI

ASN 48090 · 93.123.109.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 1,799 événements sur la période pour cette IP.

93.123.109.214 Tentative d'exploit 02/11/2026 13:48 UTC
45.148.10.238 Traversal LFI 01/11/2026 18:12 UTC
195.178.110.50 Sonde fichier configuration 29/10/2026 18:36 UTC
45.148.10.125 Sonde fichier configuration 23/10/2026 05:02 UTC
45.148.10.151 Sonde SSH 22/10/2026 15:36 UTC
195.178.110.204 Injection PHP 22/10/2026 14:39 UTC
45.148.10.152 Sonde SSH 22/10/2026 14:37 UTC
45.148.10.141 Sonde SSH 22/10/2026 14:32 UTC

Événements (filtres)

1,799

Première observation

27/10/2026 08:00 UTC

Dernière observation

27/10/2026 09:31 UTC

Dernière activité (filtres)

27/10/2026 09:31 UTC

Événements 7j

1,799

Ports distincts (7j)

926

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

TLS TCP 700 HTTP TCP 123 RDP TCP 5 HTTPS TCP 5 COUCHBASE TCP 4 WINRM TCP 4 ELASTICSEARCH TCP 4 POSTGRES TCP 3 VNC TCP 3 SAP Diag TCP 3 ETCD TCP 3 SMTP ALT TCP 3 WEBLOGIC CLUSTER TCP 3 SMB TCP 3 CLOUDFLARE TUNNEL TCP 3 HDFS NAMENODE TCP 3 LOGIN TCP 2 MEMCACHED ALT TCP 2 KAFKA JMX TCP 2 UNREAL GAME TCP 2

TLS

700

HTTP

123

RDP

HTTPS

COUCHBASE

WINRM

Géolocalisation

Origine réseau déclarée

Bulgarie unknown unknown

FAI / réseau

Opérateur et dernière activité ban

Techoff Srv Limited 0 Port 11434 Scan de ports

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Reconnaissance

Chaîne d'attaque

Reconnaissance

Vecteur d'attaque

port scan syn · via PERSONAL AGENT:5555 · (reconnaissance)

Détails protocole

Port / service

5555 · PERSONAL AGENT

Service émulé

PERSONAL-AGENT

Raison confiance

Confiance 100 % — 1 signal(aux) capteur

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min)

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Signaux de précision

MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S

Confiance

100% Corrélation +23

Famille de menace

scanner

MITRE ATT&CK — tactiques observées

Reconnaissance

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

1,799 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

1799 événement(s) — page 3/72

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
27/10/2026 09:31:47 UTC	TCP	7779 · UNREAL GAME	unreal-game	Scan de ports port scan syn · via UNREAL GAME:7779 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole Émulateur UNREAL-GAME WAF — Recommandation Surveiller Tags net_flood unreal_game_emulated unreal_game_payload Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7779 Chemin / cible — Service UNREAL GAME Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 3 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"ffffffff54536f7572636520456e67696e6520517565727900","emulator_response_len":25,"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":"unreal-game","app_proto":"unreal-game","asn":48090,"country":"BG","dst_port":7779,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":5.7,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":42,"tag_count":3,"anomaly_count":0,"campaign_key":"6ed40882eb8b5448b489f605580b0f6f7bf9e0c8","event_fingerprint":"24dc8784744933be724f9c1d7725eebb479a145b","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"unreal-game","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"pa…
27/10/2026 09:31:47 UTC	TCP	15000 · TLS	tls	Scan de ports port scan syn · via TLS:15000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 15000 Chemin / cible — Service TLS Payload {w��{~��n%.�� E�~5\m��/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w��{~��n%.�� E�~5\m��/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.71758976052905,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":15000,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":5.7,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"2df177949c68f0793bb145ab6dc4edbe31e3b753","event_fingerprint":"a02e645e9c00ebd648ba88fb11a5369ff343bd8c","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f34191…
27/10/2026 09:31:47 UTC	TCP	7085	—	Scan de ports port scan syn · port 7085 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7085 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7085,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"65268589a7a836ef47809d8382bd921c44795032","event_fingerprint":"c5ec1758beb1a1954a769fce95c79c7edfa3b955","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7085,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	7778 · INTERWISE	interwise	Scan de ports port scan syn · via INTERWISE:7778 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole Émulateur INTERWISE WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7778 Chemin / cible — Service INTERWISE Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420696e7465727769736520726561647920706f72743d373737380d0a","emulator_response_len":40,"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":"interwise","app_proto":"interwise","asn":48090,"country":"BG","dst_port":7778,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.8,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"e0498214e870ce75012b5940603538a6280739c3","event_fingerprint":"54c11a60f74ceb87984dbf8e0bfe0525a7ec357b","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"interwise","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":f…
27/10/2026 09:31:47 UTC	TCP	7403	—	Scan de ports port scan syn · port 7403 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7403 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7403,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"8e04ce45b029e2c4763a3de53af31c769e260681","event_fingerprint":"4e1f0d115ec2a3cfe8a1960495d1334d68d1c21d","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7403,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	7079	—	Scan de ports port scan syn · port 7079 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7079 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7079,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"2e3adc19574116670599c618ab1e2cd24e839e65","event_fingerprint":"2cf458796321b76d4ef80c9913024e6ff0a53688","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7079,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	7082	—	Scan de ports port scan syn · port 7082 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7082 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7082,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"e828e9ae98dfe9944ebaa89d55b3d485ff8f9ebe","event_fingerprint":"af01c146be178d7d8ac2a3789196e856b9409d69","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7082,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	14903 · TLS	tls	Scan de ports port scan syn · via TLS:14903 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 14903 Chemin / cible — Service TLS Payload {wGL5�\|=�I��~dwML��S3�/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {wGL5�\|=�I��~dwML��S3�/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.797984245337279,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":14903,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":5.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"554cbc0ae2ed75ec8d083063b422d4f78cfe2375","event_fingerprint":"b884bf2d713500b5b5db35bf088be9699e3f599e","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f3419…
27/10/2026 09:31:47 UTC	TCP	16010 · TLS	tls	Scan de ports port scan syn · via TLS:16010 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 16010 Chemin / cible — Service TLS Payload {w��\|u��n&��F4m��VJ��מ�/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w��\|u��n&��F4m��VJ��מ�/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.8671620029331635,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":16010,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":3.6,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"8ae7d0db7f6e41202a441921fed8809880cee4d5","event_fingerprint":"383be25667edc840cd1df27c62f8477fae23a229","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f341…
27/10/2026 09:31:47 UTC	TCP	7548	—	Scan de ports port scan syn · port 7548 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7548 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7548,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.8,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"4b0ce26fc8edc94b8204619ab950c061c041958f","event_fingerprint":"89e694ecf1ddcc414cf613e4add3738fe2c4eebc","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7548,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	7070	—	Scan de ports port scan syn · port 7070 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7070 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7070,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.7,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"2a67acf8cafa726c63eaf0ff369d567ec586d3d9","event_fingerprint":"5028d63b539a65496b39029800c445dbc79473d9","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7070,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	14900 · TLS	tls	Scan de ports port scan syn · via TLS:14900 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 14900 Chemin / cible — Service TLS Payload {wwـ��P�X�<�W$��j1��`�Rba�/�+�� /5� 4 � Pourquoi cette classification :* Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {wwـ��P�X�<�W$��j1��`�*Rba�/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.8305217221840016,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":14900,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":4.6,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"fffd73dc8eb24a561beff02cb8a2eb97373efa0c","event_fingerprint":"e6b27c83640a778e95a9fbea3e2ee735e62f6b48","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f341…
27/10/2026 09:31:47 UTC	TCP	7775	—	Scan de ports port scan syn · port 7775 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7775 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7775,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"9ca033a8e69bb47f668f73d44b6c024487f79243","event_fingerprint":"290c65b03c9cfb422808af8aec2d965f56d9a944","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7775,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	7022	—	Scan de ports port scan syn · port 7022 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7022 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7022,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.9,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"0e07d000cd984c35d04db81557403a8e37cd1bef","event_fingerprint":"ac60f2008a5079e0324c58dd9b6826ef913bc02f","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7022,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	1604 · TLS	tls	Scan de ports port scan syn · via TLS:1604 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1604 Chemin / cible — Service TLS Payload {w��+~p�[��"��Tݷ�#�,+/��;\�/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w��+~p�[��"��Tݷ�#�,+/��;\�/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.80849188571186,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":1604,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":5.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"081c89ed010ea1b72bd93773ccafe8e9791e06d8","event_fingerprint":"812794ffc6ffe246da7d13f098bee7733ae396cf","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f34191e…
27/10/2026 09:31:47 UTC	TCP	7050	—	Scan de ports port scan syn · port 7050 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7050 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7050,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.4,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"27a28d67be0f13d80c7b05cdc986c38768ac157f","event_fingerprint":"29c7087bd2877d49a8e059402e06efb63cad5880","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7050,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	14905 · TLS	tls	Scan de ports port scan syn · via TLS:14905 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 14905 Chemin / cible — Service TLS Payload {w/= 1�\|j+ϼ�K!�W��.�N�"�9PN�/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w/= 1�\|j+ϼ�K!�W��.�N�"�9PN�/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.798764444322512,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":14905,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":5.4,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"1b3063e5cd4d48a721deae02beeb7eeb65047cd3","event_fingerprint":"30ed3a6c90a0b91d5ebb89dcfceac03c370f77e3","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f3419…
27/10/2026 09:31:47 UTC	TCP	7083	—	Scan de ports port scan syn · port 7083 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7083 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7083,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.8,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"c55321d5bacfe097568a8c5e81a43a423d9b9c15","event_fingerprint":"2cd0457d32a31de092be6e86026a977da4eca22f","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7083,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	15040 · TLS	tls	Scan de ports port scan syn · via TLS:15040 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 15040 Chemin / cible — Service TLS Payload {wCv�9#�f�^��x�N��6M��/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {wCv�9#�f�^��x�N��6M��/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.817006421854986,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":15040,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":2.2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"882ab4cc74348e999c9938a944aeb1147386aa03","event_fingerprint":"0e1ff8506db7a988b23b95f7958edaaf01336e6e","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f3419…
27/10/2026 09:31:47 UTC	TCP	15018 · TLS	tls	Scan de ports port scan syn · via TLS:15018 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 15018 Chemin / cible — Service TLS Payload {w�hw\H��T�� H��侞`)�/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w�hw\H��T�� H��侞`)�/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.857434561543816,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":15018,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":3.6,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"329a921874b14e1e5137c0a020ed7ddb81035ffd","event_fingerprint":"38346a230ed0294d610d9519ac8929046db75246","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f3419…
27/10/2026 09:31:47 UTC	TCP	15151 · TLS	tls	Scan de ports port scan syn · via TLS:15151 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 15151 Chemin / cible — Service TLS Payload {w��x��&�v��OCtY�I_��2��/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w��x��&�v��OCtY�I_��2��/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.857434561543816,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":15151,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":5.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"83c92111e02d0b50f3fe358cf129a3dec2d607a0","event_fingerprint":"01eecabde8661a60aaa5f9e1a2595a5e5f0d1b92","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f3419…
27/10/2026 09:31:47 UTC	TCP	15588 · TLS	tls	Scan de ports port scan syn · via TLS:15588 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 15588 Chemin / cible — Service TLS Payload {w�/@�LD��\8��f�k��2-,حPnm��/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w�/@�LD��\8��f�k��2-,حPnm��/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.821528769891415,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":15588,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":5.6,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"5e8d5dcdc961d9f2927338e6d49c23fee3f28bf7","event_fingerprint":"b2477fa4bf8a1bde12ebd43dd247318d5804092b","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f3419…
27/10/2026 09:31:47 UTC	TCP	7510	—	Scan de ports port scan syn · port 7510 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7510 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7510,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.6,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"7f8a0f8b1ee5c4720b435c247eb7352dfb17ef36","event_fingerprint":"5d205f24c5e2fe2a9df67b93cfefb7a5991be072","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7510,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	7086	—	Scan de ports port scan syn · port 7086 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_flood Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7086 Chemin / cible — Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Meta JSON brut {"bytes_in":4,"payload_entropy":1,"port_category":"registered","org":"Techoff Srv Limited","service":null,"app_proto":null,"asn":48090,"country":"BG","dst_port":7086,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"821d3644d291d607f708a2edee3f4242d1a36ab8","event_fingerprint":"f899c20248cf5f927156ce9535b1da312b24dfcf","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"b94f13a5c07a89598ff9c517dbb26d84","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_context":{"dst_port":7086,"risk_score":42},"payload_preview":" …
27/10/2026 09:31:47 UTC	TCP	16030 · TLS	tls	Scan de ports port scan syn · via TLS:16030 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole JA3 cba7f34191ef2379 Émulateur TLS WAF — Recommandation Surveiller Tags net_flood tls_ja3 tls_no_sni tls_weak_cipher Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 16030 Chemin / cible — Service TLS Payload {w2�';�4b7�G�:T~��pG��t��d�/�+�� /5� 4 � Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +23 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 4 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance User-Agent — Règles WAF — Payload (extrait) {w2�';�4b7�G�:T~��pG��t��d�/�+�� /5� 4 � Meta JSON brut {"tls_ja3_hash":"cba7f34191ef2379c1325641f6c6c4f4","tls_sni":null,"tls_weak_cipher":true,"tls_weak_cipher_count":6,"bytes_in":128,"payload_entropy":4.854586686726627,"port_category":"registered","org":"Techoff Srv Limited","service":"tls","app_proto":"tls","asn":48090,"country":"BG","dst_port":16030,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":43,"risk_novelty":15,"risk_boost":6,"risk_granularity":1.9,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15},"risk_score":42,"tag_count":4,"anomaly_count":0,"campaign_key":"74d4eaa66d7f34fc0dcb82855ae7e6b3a86f1eac","event_fingerprint":"5218959f204f2e1903e955633c3ffb2c24e520e1","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":42,"correlation_boost":23},"named_classification_skipped":false,"service_name":"tls","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"BG","asn":48090,"org":"Techoff Srv Limited","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"ja3":"cba7f3419…

93.123.109.124

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence