Fiche IP

Allemagne

93.152.221.37

Activité suspecte · risque 34/100

FAI TechTies Inc. Première vue 16/10/2026 00:58 UTC Dernière vue 04/11/2026 19:41 UTC Risque Moyen

Période 2026-10-05 → 2026-11-04

Moyen 50/100

24h 7j 30j 90j

Synthèse

Score de risque max. 50/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 16/10/2026 00:58 UTC

Dernière observation 04/11/2026 19:41 UTC

Événements (période) 456

Décision conseillée Surveiller Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal T1046 422 occurrences

Pourquoi listée

Type « Sonde SAP ICM HTTP » (signaux protocolaires) · confiance 0%

Confiance 0 % — 3 signal(aux) capteur

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

50/100 Confiance 0 % 456 événements T1046

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 93.152.221.37
Décision : Investiguer
Score max : 50/100 (Moyen)
Confiance : 0 %
Période : 2026-10-05 → 2026-11-04 · 456 événements
Motif : Type « Sonde SAP ICM HTTP » (signaux protocolaires) · confiance 0%
MITRE : T1046
FAI : TechTies Inc. · Allemagne

Comparaison ASN / FAI

ASN 197170 · 93.152.221.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 456 événements sur la période pour cette IP.

45.153.34.230 Tentative d'exploit 04/11/2026 06:53 UTC
91.92.40.12 Prototype pollution 03/11/2026 22:05 UTC
45.153.34.249 Sonde fichier configuration 02/11/2026 17:38 UTC
85.11.167.7 Sonde API 01/11/2026 17:59 UTC
85.11.167.124 Sonde SSH 31/10/2026 17:01 UTC
176.65.132.19 Prototype pollution 31/10/2026 04:13 UTC
91.92.40.244 Énumération API REST 29/10/2026 18:35 UTC
176.65.132.126 SSRF 26/10/2026 01:24 UTC

Événements (filtres)

456

Première observation

16/10/2026 00:58 UTC

Dernière observation

04/11/2026 19:41 UTC

Dernière activité (filtres)

04/11/2026 19:41 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

SSH TCP 160 HTTP TCP 24 SCM ACTUATOR PROBE TCP 5 SQUID TCP 4 Telnet TCP 4 HTTP ALT 8082 TCP 3 MEMCACHED ALT TCP 3 CICS ALT TCP 3 SAP Diag TCP 3 SOCKS5 TCP 3 MINIKUBE NODEPORT TCP 2 SSH ALT2 TCP 2 TCPMUX TCP 2 IRC ALT TCP 2 I2P TCP 2 NODE HTTP TCP 2 ADMIN ALT TCP 2 ACCESSBUILDER TCP 2 HTTP ALT 8088 TCP 1 PROMETHEUS TCP 1

SSH

160

HTTP

SCM ACTUATOR PROBE

SQUID

Telnet

HTTP ALT 8082

Géolocalisation

Origine réseau déclarée

Allemagne unknown unknown

FAI / réseau

Opérateur et dernière activité ban

TechTies Inc. 0 Port 22 Scan de ports

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

Sonde SAP ICM / WebDynpro · via SAP ICM:8000 · (sonde / probe)

Détails protocole

Aperçu payload

CONNECT 93.152.221.37:80 HTTP/1.0 Host: 93.152.221.37:80 Proxy-Authorization: Basic NTAxOTY6NTAxOTY=

Port / service

8000 · SAP ICM

Service émulé

SAP-ICM

Raison confiance

Confiance 0 % — 3 signal(aux) capteur

Technique MITRE

TA0007

Persona capteur

mail.sensor-1.internal

Recommandation

Surveiller

Rôle capteur

Renseignement menaces

Confiance

0% Confiance non établie

Famille de menace

sap_probe IP signalée (IPsum, 3 listes ou plus)

MITRE ATT&CK — tactiques observées

Découverte Accès initial

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

456 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

456 événement(s) — page 7/19

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
19/10/2026 22:10:59 UTC	TCP	30099	—	Scan de ports port scan syn · port 30099 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 30099 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":30099,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"c88462dcd73b79c71112801c337a0dfc64d8d049","event_fingerprint":"f985139a0a08a9a225aeffcc45d13a9b8b473ec3","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"6a…
19/10/2026 22:10:39 UTC	TCP	30001	—	Scan de ports port scan syn · port 30001 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 30001 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":30001,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"bb2b60fadc41e12794a99d7d62c207ecb3583461","event_fingerprint":"0283cd1fec63ff138c32cdbd83d2aa87af30e346","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"…
19/10/2026 22:10:38 UTC	TCP	30867	—	Scan de ports port scan syn · port 30867 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 30867 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":30867,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.9,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"415ba6a00676a0882a569a3ca5ae9d49beb01967","event_fingerprint":"8babf355593904a845b1eaaa9f8fe6725c6b07ef","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"…
19/10/2026 22:10:31 UTC	TCP	8822	—	Scan de ports port scan syn · port 8822 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8822 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":8822,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"abdf33713b4dcb2ef5c14b8067a39a11ab587919","event_fingerprint":"815c101a961b9ec3fc5156ccf12f34a1ec52b049","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"6…
19/10/2026 22:10:30 UTC	TCP	11011	—	Scan de ports port scan syn · port 11011 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 11011 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":11011,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"c6618db46477bae0772be627007a17de71ffcab3","event_fingerprint":"2b39aff0b53a31ed689b4298dd75e41944d8d4b5","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"…
19/10/2026 22:10:22 UTC	TCP	1211	—	Scan de ports port scan syn · port 1211 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1211 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":1211,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.7,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"a8d9cc4ab7783b565a0302b45975ed02444bb211","event_fingerprint":"91d21107ce961298614329ee14c957061fce301b","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":18},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"6…
19/10/2026 22:10:22 UTC	TCP	1 · TCPMUX	tcpmux	Scan de ports port scan syn · via TCPMUX:1 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole Émulateur TCPMUX WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1 Chemin / cible — Service TCPMUX Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"well_known","org":"TechTies Inc.","service":"tcpmux","app_proto":"tcpmux","asn":197170,"country":"DE","dst_port":1,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"c9fedc34c6e372376596169e353b2ff46fe169c6","event_fingerprint":"71e70cc9d1dfc22d38bdc4d2703aa0c3aacb1732","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"service_name":"tcpmux","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc…
19/10/2026 22:10:21 UTC	TCP	2001	—	Scan de ports port scan syn · port 2001 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2001 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":2001,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"e12c67a8003a1bdfba65c69d0cba6289678d9daf","event_fingerprint":"dec733f38c33bb58d438fdb636158106a3024b4e","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"6…
19/10/2026 22:10:00 UTC	TCP	111 · RPCBIND	rpcbind	Scan de ports port scan syn · via RPCBIND:111 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole Émulateur RPCBIND WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 111 Chemin / cible — Service RPCBIND Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f742072706362696e6420726561647920706f72743d3131310d0a","emulator_response_len":37,"bytes_in":4,"payload_entropy":1.5,"port_category":"well_known","org":"TechTies Inc.","service":"rpcbind","app_proto":"rpcbind","asn":197170,"country":"DE","dst_port":111,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.2,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"5e862b0e8ebef2f7d7e14cd904ab31be622c87e3","event_fingerprint":"6c0a0c238a05a5109aafc0676ca60b62c31bfddb","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"service_name":"rpcbind","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"…
19/10/2026 22:09:52 UTC	TCP	1037	—	Scan de ports port scan syn · port 1037 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1037 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":1037,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"4fad22c9354ed9f27ea850f832d7cb53032364c3","event_fingerprint":"2db96770188ee73a7f8637e2df04a1b67266d8a0","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"6…
19/10/2026 22:09:31 UTC	TCP	1036	—	Scan de ports port scan syn · port 1036 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1036 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":1036,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.4,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"f21527012b844996e3ec984589e47c7e2c9555cb","event_fingerprint":"fa171cc1e3bfc1445c671b7bd5a2e81bba62d198","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"6…
19/10/2026 22:09:31 UTC	TCP	8838	—	Scan de ports port scan syn · port 8838 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8838 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":8838,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.8,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"363baad4a47562f41eed01bd9729d0794ecf0989","event_fingerprint":"b6b1aee58c4151db21f3c4dfe461193eaeb37767","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"6…
19/10/2026 22:09:19 UTC	TCP	10000 · WEBMIN	webmin	Scan de ports port scan syn · via WEBMIN:10000 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan rapide multi-ports Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole Émulateur WEBMIN WAF — Recommandation Surveiller Tags net_port_scan_slow webmin_emulated Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10000 Chemin / cible — Service WEBMIN Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 2 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204d696e69536572762f322e3030300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e5765626d696e206c6f67696e3c2f626f64793e3c2f68746d6c3e","emulator_response_len":126,"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":"webmin","app_proto":"webmin","asn":197170,"country":"DE","dst_port":10000,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.6,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":42,"tag_count":2,"anomaly_count":0,"campaign_key":"2638793ad7c6b03966423bdd6f2c1e344bda8f8a","event_fingerprint":"7d6ec044872c6063c775baa9f1b4cf45118033b7","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_s…
19/10/2026 22:09:17 UTC	TCP	27863	—	Scan de ports port scan syn · port 27863 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 27863 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":27863,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"e9df557b01b9fa4624e8d2b2df0efa34c61583e6","event_fingerprint":"abf9cec39cca89adb174f7da3f0885f8c0f11a74","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"…
19/10/2026 22:09:16 UTC	TCP	31947	—	Scan de ports port scan syn · port 31947 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 31947 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":31947,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"17469668e69193389f2ef7f25f756c881e5a9a0a","event_fingerprint":"2fb39e5f01eefcf4bc92486fe4e1a299e00587b7","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"…
19/10/2026 22:09:09 UTC	TCP	1035	—	Scan de ports port scan syn · port 1035 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1035 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":1035,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"0f50497b60eebab8d2103782a6d2298acb925ae7","event_fingerprint":"52ea6d3f73266226da65fdbf818a75252cc69fff","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"6…
19/10/2026 22:09:07 UTC	TCP	13128	—	Scan de ports port scan syn · port 13128 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 13128 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":13128,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.8,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"bea6381136e508d8d6941a81ddd668a5a1ac77a8","event_fingerprint":"f654c990b1bb3863625581a36931b02ebce47488","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"…
19/10/2026 22:08:58 UTC	TCP	31136	—	Scan de ports port scan syn · port 31136 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 31136 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":31136,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"436cfdc52f9eee07cd3df241a3e11a0cc6ff5fd2","event_fingerprint":"9d6e0143cee8f792e5cfe3d52ee9539897a4f191","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"…
19/10/2026 22:08:53 UTC	TCP	1039	—	Scan de ports port scan syn · port 1039 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 1039 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":1039,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.9,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"1233e1fa7b613f3d59ff368e14497d3e1fee5f6d","event_fingerprint":"a6381c97e2a0852e4b1fe0f82957f6fc9f12eee5","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_…
19/10/2026 22:08:18 UTC	TCP	30007	—	Scan de ports port scan syn · port 30007 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 30007 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +24 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":30007,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":5.1,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"23f37b771c00f2903906dbe86079df17b83ccaf9","event_fingerprint":"c51123690567a5d17d2fca8ae5eac238ebba26f3","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":24},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target…
19/10/2026 22:08:07 UTC	TCP	5915	—	Scan de ports port scan syn · port 5915 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 5915 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":5915,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.3,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"0c713293d9c4abb4af0ab00ea7f48dd237009c3b","event_fingerprint":"3c188240e8df67ee67913c4aad92f4ee5a22b273","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":18},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_…
19/10/2026 22:08:03 UTC	TCP	7108	—	Scan de ports port scan syn · port 7108 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 7108 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +18 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":7108,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":1.8,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"e13b0fe1adf5e31d92f447c4bb60a8b7ec52ecd4","event_fingerprint":"1f2a2d5e8dcc57f7004fae8c00beb6b7a12206b2","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":231,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":18},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"6a708bf69e8680803ad7dadb39e2e4d9"},"target_…
19/10/2026 22:07:46 UTC	TCP	2005	—	Scan de ports port scan syn · port 2005 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Scan coordonné Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2005 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +24 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":2005,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.7,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"94dafd12771aa55d64df8c2f3840de23a45b12e5","event_fingerprint":"da113dd371739aadab61b669e82fa045e3b33097","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":24},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"6…
19/10/2026 22:07:03 UTC	TCP	10042	—	Scan de ports port scan syn · port 10042 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 10042 Chemin / cible — Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":null,"app_proto":null,"asn":197170,"country":"DE","dst_port":10042,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":8,"risk_novelty":0,"risk_boost":0,"risk_granularity":5,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"3c3f329e8b6830a3067110aaf6b7a1ad61524175","event_fingerprint":"0ab214c2bac3fb64c60543e1d85845db6255c102","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":8,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"DE","asn":197170,"org":"TechTies Inc.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"6ce5e83bce8f65c890fae2bc4bd3a7a8","path_pattern_hash":"6a…
19/10/2026 22:06:55 UTC	TCP	8081 · HTTP ALT 8081	http-alt-8081	Scan de ports port scan syn · via HTTP ALT 8081:8081 · (reconnaissance)	Élevée	Moyen · 42
Étape Reconnaissance Chaîne Reconnaissance Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Campagne multi-ports Multi-protocole corrélé (5 min) MITRE T1046 Reconnaissance Protocole Émulateur HTTP-ALT-8081 WAF — Recommandation Surveiller Tags net_port_scan_slow Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 8081 Chemin / cible — Service HTTP ALT 8081 Payload Pourquoi cette classification : Type « Scan de ports » (signaux protocolaires) · confiance 100% Confiance classification 100% Corrélation +14 Risque capteur Moyen · 42 Confiance : Confiance 100 % — 1 signal(aux) capteur Protocole émulé 1 Signaux MITRE-T1046 SIGMA-net-port-scan Beh Scan Burst Beh Multi Port 60S Technique MITRE T1046 Tactiques MITRE Reconnaissance Motifs de détection (base) Minecraft varint handshake User-Agent — Règles WAF — Payload (extrait) Meta JSON brut {"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"bytes_in":4,"payload_entropy":1.5,"port_category":"registered","org":"TechTies Inc.","service":"http-alt-8081","app_proto":"http-alt-8081","asn":197170,"country":"DE","dst_port":8081,"risk_waf":8,"risk_classification":64,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.7,"risk_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":42,"tag_count":1,"anomaly_count":0,"campaign_key":"b1480dd242bebbcf43f779f075d7179e8f85e33e","event_fingerprint":"ebf28728b9d7290f16bf5aece33e7a9c5c736dd9","classification_reason":"Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":293,"precision_signals":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"kb_rule_ids":["MITRE-T1046","SIGMA-net-port-scan","INT-beh-scan-burst","INT-beh-multi-port-60s"],"matched_patterns":["pat-0554"],"matched_pattern_names":["Minecraft varint handshake"],"pattern_ids":["pat-0554"],"confidence_breakdown":{"waf":8,"classification":64,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":42,"correlation_boost":14},"named_classification_skipped":false,"servi…

93.152.221.37

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence