Fiche IP

Russie

95.213.194.75

Activité suspecte — risque 50/100 (Moyen) — MITRE T1046 — confiance 100 % — via SSH

FAI JSC Selectel Première vue 16/10/2026 07:25 UTC Dernière vue 21/10/2026 14:20 UTC Risque Moyen

Période 2026-09-23 → 2026-10-23

Moyen 50/100

24h 7j 30j 90j

Synthèse

Score de risque max. 50/100 Moyen · Maximum de risk_score (événements honeypot)

Première observation 16/10/2026 07:25 UTC

Dernière observation 21/10/2026 14:20 UTC

Événements (période) 49

Décision conseillée Investiguer Observer, investiguer ou bloquer. Le site ne pousse pas de règle pare-feu.

MITRE ATT&CK principal T1046 49 occurrences

Pourquoi listée

Bannière client SSH reçue · confiance 100%

Confiance 100 % — Score WAF 8

Décision

Investiguer

Risque moyen. Relisez le port dominant et les preuves avant toute règle réseau.

50/100 Confiance 100 % 49 événements T1046

À faire

Lire les preuves de la chronologie avant d’écrire une règle.
Comparer avec les IP du même FAI.
Annoter le verdict vrai positif ou faux positif.

Preuves JSON SOC CEF STIX Ticket nftables

Note de ticket

IP 95.213.194.75
Décision : Investiguer
Score max : 50/100 (Moyen)
Confiance : 100 %
Période : 2026-09-23 → 2026-10-23 · 49 événements
Motif : Bannière client SSH reçue · confiance 100%
MITRE : T1046
FAI : JSC Selectel · Russie

Comparaison ASN / FAI

ASN 49505 · 95.213.194.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 49 événements sur la période pour cette IP.

161.104.46.194 Sonde PostgreSQL 20/10/2026 04:27 UTC
109.236.57.14 Sonde SOCKS5 01/08/2026 10:59 UTC
82.148.21.118 Sonde RemoteAnything 28/07/2026 01:06 UTC
95.215.56.196 Sonde Teamcity 17/07/2026 16:54 UTC
92.53.64.192 Agent personnel 20/06/2026 12:43 UTC
185.151.241.139 Sonde port 08/05/2026 02:10 UTC
87.228.27.46 Sonde SSH 24/04/2026 16:25 UTC
87.242.111.7 Sonde HTTP 19/04/2026 05:24 UTC

Événements (filtres)

Première observation

16/10/2026 07:25 UTC

Dernière observation

21/10/2026 14:20 UTC

Dernière activité (filtres)

21/10/2026 14:20 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

Élevée

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

SSH TCP 36 WHOIS TCP 1 SMTP ALT TCP 1 CHARGEN TCP 1 FTP TCP 1 DAYTIME TCP 1 Telnet TCP 1 FTP DATA TCP 1 NAMESERVER TCP 1 DISCARD TCP 1 QOTD TCP 1 TACACS TCP 1 ECHO TCP 1 DNS TCP 1

SSH

WHOIS

SMTP ALT

CHARGEN

FTP

DAYTIME

Géolocalisation

Origine réseau déclarée

Russie unknown unknown

FAI / réseau

Opérateur et dernière activité ban

JSC Selectel 0 Port 61 Sonde SSH

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Sonde / probe

Chaîne d'attaque

Découverte

Vecteur d'attaque

Sonde SSH · via SSH:61 · (sonde / probe)

Détails protocole

Bannière SSH: SSH-2.0-OpenSSH

Aperçu payload

SSH-2.0-OpenSSH

Port / service

61 · SSH

Service émulé

SSH

Raison confiance

Confiance 100 % — Motif catalogue confirmé

Technique MITRE

T1046

Persona capteur

mail.sensor-1.internal

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0387 pat-0391 Upstream

Confiance

100%

Famille de menace

scanner

MITRE ATT&CK — tactiques observées

Découverte Accès initial

Décomposition confiance

Décomposition du score

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Profil d’activité

Heures UTC et jours de la semaine, calculés sur les séries de la page

Heures UTC

Jours de semaine

Constats

Lecture automatique du volume, des ports et des créneaux UTC

Timeline

49 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

Part du volume sur la période filtrée

Top classifications

Libellés capteur, part du volume

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

49 événement(s) — page 1/2

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
21/10/2026 14:20:15 UTC	TCP	61 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:61 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 61 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":61,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":5.1,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"3712e9b578f7e952103cced5806327535e62dd77","event_fingerprint":"5f856b8802e483b4c694b79c8d41e64c88e8ada6","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_context":{"dst_port":6…
21/10/2026 14:01:56 UTC	TCP	52 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:52 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 52 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":52,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.7,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"3b252f8dd5277ccdb91207034d414024cbbc4079","event_fingerprint":"236bb70d35af60e748ae85efad279c5c262e2270","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_context":{"dst_port":5…
21/10/2026 12:39:44 UTC	TCP	53 · DNS	dns	Sonde SSH Sonde SSH · via DNS:53 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 Découverte Accès Protocole Émulateur DNS WAF — Recommandation Investiguer Tags dns_emulated dns_payload net_dns_probe ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 53 Chemin / cible — Service DNS Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0387 pat-0391 Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"protocol_emulated":true,"emulator_response":"5353c823322e00004f70656e5353480d0a","emulator_response_len":17,"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"dns","app_proto":"dns","asn":49505,"country":"RU","dst_port":53,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.9,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":50,"tag_count":4,"anomaly_count":0,"campaign_key":"ee6739e6608cfb862752019edee42d351689a634","event_fingerprint":"a8ecfe27665a94483df3963a81bc8aaa2d3740ad","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":116,"precision_signals":["pat-0387","pat-0391"],"kb_rule_ids":["pat-0387","pat-0391"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"service_name":"dns","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021…
21/10/2026 12:39:30 UTC	TCP	54 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:54 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 54 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":54,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":4,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"bc6924485c5a686d6ce483d360d91b06f11637d4","event_fingerprint":"e0f38a3c0dd4a9293195e3bf7bc2a97459566503","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_context":{"dst_port":54,…
21/10/2026 12:35:16 UTC	TCP	60 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:60 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 60 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":60,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":5,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"11cf0440bfd8ef58484a40dc2054cdb241860174","event_fingerprint":"f40d25846d6a1788a52ee2b466478c53d7980634","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_context":{"dst_port":60,…
21/10/2026 12:30:35 UTC	TCP	59 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:59 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 59 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":59,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.8,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"474b57f0a4b61c1baec2a2d421ed5bd0f6eedcd6","event_fingerprint":"d8b80c08cdd7af104478fdf671f61d76dbb49197","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_context":{"dst_port":5…
21/10/2026 09:43:41 UTC	TCP	58 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:58 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 58 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":58,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.7,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"57cd03b9cbea8432d20c003fba9fc225e1b86449","event_fingerprint":"4fa1930f308464d3e486fded41a6c2d292615897","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_context":{"dst_port":5…
21/10/2026 09:35:44 UTC	TCP	57 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:57 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 57 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":57,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.5,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"903db337096f53bcf372bb1d63e2a0ac813fe217","event_fingerprint":"e09603fa2f4640680e04b21a43c44a9c6260afba","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_context":{"dst_port":5…
21/10/2026 09:23:01 UTC	TCP	56 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:56 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 56 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":56,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.3,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"a55341275883c9e1783daa2e318d11920a86fa3c","event_fingerprint":"6e2db7adf76af6a2a2ab0deb85c8cbbd831b79b6","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_context":{"dst_port":5…
21/10/2026 09:01:30 UTC	TCP	55 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:55 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 55 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":55,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.2,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"bb480e3cbb1671ef4a024c5a029f775e187fd7e6","event_fingerprint":"184ea3dac78791495b89c2e3522630069891ad50","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_context":{"dst_port":5…
20/10/2026 15:25:39 UTC	TCP	15 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:15 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 15 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":15,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.8,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"52b20c9e880db04a27edecd044f2545801408bbf","event_fingerprint":"746305abb31332c37f7f8590122196ec6a406ca6","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_…
20/10/2026 15:21:04 UTC	TCP	17 · QOTD	qotd	Sonde SSH Sonde SSH · via QOTD:17 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole Émulateur QOTD WAF — Recommandation Investiguer Tags net_ssh_probe ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 17 Chemin / cible — Service QOTD Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420716f746420726561647920706f72743d31370d0a","emulator_response_len":33,"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"qotd","app_proto":"qotd","asn":49505,"country":"RU","dst_port":17,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.4,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":50,"tag_count":2,"anomaly_count":0,"campaign_key":"37f1fb52727194d6041ce39655dec59c706894a1","event_fingerprint":"d68976fd39f9a08d0db40f985e71991d359cc25b","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"qotd","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"finger…
20/10/2026 13:48:17 UTC	TCP	16 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:16 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 16 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":16,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.9,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"e93e8de54d756a34041c50d16d5fa6a415505015","event_fingerprint":"88050b4fd7c982edd511a1104021a8749b9966e9","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_context":{"dst_port":1…
20/10/2026 13:28:58 UTC	TCP	20 · FTP DATA	ftp-data	Sonde SSH Sonde SSH · via FTP DATA:20 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole Sonde protocole FTP Émulateur FTP-DATA WAF — Recommandation Investiguer Tags net_ssh_probe ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 20 Chemin / cible — Service FTP DATA Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f7420465450205365727665722072656164792e0d0a","emulator_response_len":32,"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ftp-data","app_proto":"ftp-data","asn":49505,"country":"RU","dst_port":20,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.9,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":50,"tag_count":2,"anomaly_count":0,"campaign_key":"2c6dc123d24effb3265a19539304ab650a7255e8","event_fingerprint":"ada8505ea09376022f1d3aff83022f463e72d611","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ftp-data","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":fals…
20/10/2026 13:20:59 UTC	TCP	11 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:11 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 11 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":11,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.1,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"0cf72d4a9a5a83ae9dbf8b389fc3ac5be908a650","event_fingerprint":"b0ea1e6d10faff9d7a4f791fb3e989f628b6571f","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_…
20/10/2026 13:18:36 UTC	TCP	13 · DAYTIME	daytime	Sonde SSH Sonde SSH · via DAYTIME:13 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole Émulateur DAYTIME WAF — Recommandation Investiguer Tags net_ssh_probe ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 13 Chemin / cible — Service DAYTIME Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"protocol_emulated":true,"emulator_response":"546875204a756e2020342031323a30303a303020323032360d0a","emulator_response_len":26,"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"daytime","app_proto":"daytime","asn":49505,"country":"RU","dst_port":13,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.8,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":50,"tag_count":2,"anomaly_count":0,"campaign_key":"617770e30acc5df0c44f8225ec3f626edbdb76ba","event_fingerprint":"be48f2ef79d16baa8fd2ac88fe08977727513faf","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"daytime","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint…
20/10/2026 13:10:22 UTC	TCP	12 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:12 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 12 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":12,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.3,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"13df2699a937b1a8f2e1b5cd72344133ce7a4422","event_fingerprint":"6c2d60f1d6aa70f5846ff57a1296a097b92f9a6a","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_context":{"dst_port":1…
20/10/2026 12:39:34 UTC	TCP	14 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:14 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 14 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":14,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"1905d2109df9c705df768df8f4f1b956858a94fc","event_fingerprint":"05f45953ef214e92789001623b8d717d35232c6e","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_context":{"dst_port":1…
20/10/2026 12:32:15 UTC	TCP	18 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:18 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 18 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":18,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.2,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"0dd98d247bbe1ad0687c5f278dd0c75b6d80978f","event_fingerprint":"3fb1b22bcc2a4ce226106e37b069f196949c51cf","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_context":{"dst_port":1…
20/10/2026 12:03:46 UTC	TCP	19 · CHARGEN	chargen	Sonde SSH Sonde SSH · via CHARGEN:19 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole Émulateur CHARGEN WAF — Recommandation Investiguer Tags net_ssh_probe ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 19 Chemin / cible — Service CHARGEN Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"protocol_emulated":true,"emulator_response":"4142434445464748494a4b4c4d4e4f505152535455565758595a6162636465666768696a6b6c6d6e6f707172737475767778797a303132333435363738390d0a","emulator_response_len":64,"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"chargen","app_proto":"chargen","asn":49505,"country":"RU","dst_port":19,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.7,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":50,"tag_count":2,"anomaly_count":0,"campaign_key":"6a85a959d9d0b1671360ff7a32dc4ebdeab37afc","event_fingerprint":"c7e5dbb3c822992c3c389b56bb332c3354d79882","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"chargen","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,…
19/10/2026 19:02:40 UTC	TCP	43 · WHOIS	whois	Sonde SSH Sonde SSH · via WHOIS:43 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole Émulateur WHOIS WAF — Recommandation Investiguer Tags net_ssh_probe ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 43 Chemin / cible — Service WHOIS Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"protocol_emulated":true,"emulator_response":"252057484f495320686f6e6579706f740d0a446f6d61696e3a206578616d706c652e636f6d0d0a","emulator_response_len":39,"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"whois","app_proto":"whois","asn":49505,"country":"RU","dst_port":43,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.6,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":50,"tag_count":2,"anomaly_count":0,"campaign_key":"3227a30e7313199ce84b724a91d5c7752f3bc3b0","event_fingerprint":"a83d9ced5091ddfddccc41e1f30ff8704840f34b","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"whois","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint"…
19/10/2026 18:07:33 UTC	TCP	44 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:44 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 44 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":44,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.4,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"f764f3692aa09f0a0ada841dfcb0b7ccc689f7cb","event_fingerprint":"ba41feec0d7641201c7601ac093eeaa1214961db","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_context":{"dst_port":4…
19/10/2026 17:47:24 UTC	TCP	47 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:47 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 47 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":47,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":2.9,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"6c40e13fab1fcde785a4292c36bb553e125308c6","event_fingerprint":"7366cb0153ede9ed0413b5f059eb174ad86a6433","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_context":{"dst_port":4…
19/10/2026 17:45:48 UTC	TCP	48 · SSH	ssh	Sonde SSH Sonde SSH · via SSH:48 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE T1046 Découverte Accès Protocole SSH SSH-2.0-OpenSSH Émulateur SSH WAF — Recommandation Investiguer Tags ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 48 Chemin / cible — Service SSH Bannière SSH SSH-2.0-OpenSSH Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"ssh","app_proto":"ssh","asn":49505,"country":"RU","dst_port":48,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":36,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.1,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0},"risk_score":50,"tag_count":1,"anomaly_count":0,"campaign_key":"eb57c0c6589beef3595cafe05dec7da7f6f478e1","event_fingerprint":"3540591e08ceb5bea4582949d3483ed8216f5912","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":36,"novelty":0,"risk_score":50},"named_classification_skipped":false,"service_name":"ssh","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"58890344d4d66357021038319740ebe6","path_pattern_hash":"4368b1c212b6962fb95d1d1144451aca"},"target_context":{"dst_port":4…
19/10/2026 17:37:37 UTC	TCP	49 · TACACS	tacacs	Sonde SSH Sonde SSH · via TACACS:49 · (sonde / probe)	Élevée	Moyen · 50
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE T1046 Découverte Accès Protocole Émulateur TACACS WAF — Recommandation Investiguer Tags net_ssh_probe ssh_banner Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 49 Chemin / cible — Service TACACS Payload SSH-2.0-OpenSSH Pourquoi cette classification : Bannière client SSH reçue · confiance 100% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 100 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0387 pat-0391 Upstream Technique MITRE T1046 Tactiques MITRE Découverte Accès initial Motifs de détection (base) OpenSSH banner SSH-2.0 banner RFC4253 User-Agent — Règles WAF — Payload (extrait) SSH-2.0-OpenSSH Meta JSON brut {"protocol_emulated":true,"emulator_response":"32323020686f6e6579706f742074616361637320726561647920706f72743d34390d0a","emulator_response_len":35,"bytes_in":17,"payload_entropy":3.381580488309164,"port_category":"well_known","org":"JSC Selectel","service":"tacacs","app_proto":"tacacs","asn":49505,"country":"RU","dst_port":49,"risk_waf":8,"risk_classification":50,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":3.6,"risk_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":50,"tag_count":2,"anomaly_count":0,"campaign_key":"9436bc1616ddf2628cab34288d341a2c93fb2057","event_fingerprint":"a43f8b5e3d92d47f07617ea6f787a6fbab190dd5","classification_reason":"Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%","confidence":1,"classification_confidence":1,"precision_score":141,"precision_signals":["pat-0387","pat-0391","INT-upstream"],"kb_rule_ids":["pat-0387","pat-0391","INT-upstream"],"matched_patterns":["pat-0387","pat-0391"],"matched_pattern_names":["OpenSSH banner","SSH-2.0 banner RFC4253"],"pattern_ids":["pat-0387","pat-0391"],"confidence_breakdown":{"waf":8,"classification":50,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":50,"correlation_boost":8},"named_classification_skipped":false,"service_name":"tacacs","risk_confidence_factor":100,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":49505,"org":"JSC Selectel","is_datacenter":fa…

95.213.194.75

Pourquoi listée

Investiguer

À faire

Note de ticket

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Décomposition du score

Filtres

Profil d’activité

Heures UTC

Jours de semaine

Constats

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence