Renseignement sur les menaces

Indonésie

103.144.146.55

FAI PT.LEXXA DATA INDONUSA Première vue 21/06/2026 08:24 UTC Dernière vue 21/06/2026 11:09 UTC Risque Moyen

Période analysée : 2026-05-07 → 2026-08-05

Activité suspecte — risque 61/100 (Moyen) — MITRE TA0001 — confiance 100 % — via HTTP — multi-protocole (2 protocoles · 5 min)

Base IP Signaler JSON CSV Pro STIX 2.1 · JSON SOC ou contact

Réputation DNSBL WHOIS Ports

24h 7j 30j 90j

Moyen · Risque max (7j) Moyen

Synthèse exécutive

Profil de menace

Score de risque 61/100 Moyen

Première observation 21/06/2026 08:24 UTC

Dernière observation 21/06/2026 11:09 UTC

Événements (période) 24

MITRE ATT&CK principal TA0007 17 occurrences

Activité suspecte — risque 61/100 (Moyen) — MITRE TA0001 — confiance 100 % — via HTTP — multi-protocole (2 protocoles · 5 min)

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%

Confiance 100 % — Score WAF 100 · Bonus corrélation +8 · 4 tag(s) WAF

Comparaison ASN / FAI

ASN 139428 · 103.144.146.0/24 · APNIC · 24 événements sur la période pour cette IP.

Événements (filtres)

Première observation

21/06/2026 08:24 UTC

Dernière observation

21/06/2026 11:09 UTC

Dernière activité (filtres)

21/06/2026 11:09 UTC

Événements 7j

Ports distincts (7j)

Classifications (7j)

Sévérité max (7j)

—

Activité multi-protocole

Cette IP touche plusieurs services simulés (pas seulement le web).

CPANEL SSL TCP 17 HTTP TCP 7

CPANEL SSL

HTTP

Géolocalisation

Origine réseau déclarée

Indonésie unknown unknown

FAI / réseau

Opérateur et dernière activité ban

PT.LEXXA DATA INDONUSA 0 Port 2083 cpanel_probe

Renseignement menaces

Score capteur — surveiller, investiguer ou bloquer.

Recommandation

Stade d'attaque

Tentative d'exploit

Chaîne d'attaque

Exploitation

Vecteur d'attaque

http smuggling probe · via HTTP:2083 · (tentative d'exploit) · → /login/

Détails protocole

Méthode: POST
Chemin: /login/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36

Aperçu payload

POST /login/?login_only=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Accept-Encod

Port / service

2083 · HTTP

Service émulé

HTTP

Raison confiance

Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF

Technique MITRE

TA0001

Persona capteur

mail.sensor-1.internal

Corrélations comportementales

Multi-protocole corrélé (5 min)

Recommandation

Investiguer

Rôle capteur

Renseignement menaces

Signaux de précision

pat-0842

Confiance

100% Corrélation +8

Famille de menace

web_injection

MITRE ATT&CK — tactiques

Reconnaissance Développement Accès Exécution Persistance Élévation Contournement Accès Découverte Mouvement Collecte Commande Exfiltration Impact

Décomposition confiance

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Timeline

24 événements filtrés — activité quotidienne

Ports 24 h

Top ports ciblés sur les dernières 24 heures

Top ports

SSH 22, RDP 3389, HTTP alternatifs…

Top classifications

Web, SSH, SAP, scans…

Heatmap attaques 7j

Intensité par jour et heure (UTC capteur)

Chronologie des événements

24 événement(s) — page 1/1

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
21/06/2026 11:09:03 UTC	TCP	2083 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:2083 · (tentative d'exploit) · → /login/	Élevée	Moyen · 61
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /login/ UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 26 Recommandation Investiguer Tags 950326:rce-0 950327:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP POST /login/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 2083 Chemin / cible /login/ Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 61 Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL cPanel login path Ligne de requête `POST /login/?login_only=1 HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) POST /login/?login_only=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Accept-Encod Requête brute (extrait) POST /login/?login_only=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Accept-Encoding: gzip, deflate, br Accept: / Connection: close Host: 62.3.50.33:2083 Content-Length: 20 Content-Type: application/x-w Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "http_header_count": 7, "http_query_params": 1, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "803f4e8c96255ce9d89bb00fa3440f10f1abcc57", "http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0", "http_target_hash": "8867d3379ac5bf62897f1378b18a6965af39ff3a", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 298, "payload_entropy": 5.357680266683926, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "http", "app_proto": "http", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 61, "tag_count": 6, "anomaly_count": 0, "campaign_key": "aa298d089beef2127dc3d35f6f4565999e78dba5", "event_fingerprint": "d525a5e9fc19a0376430a62d72689974824b6ddc", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0618" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "cPanel login path" ], "pattern_ids": [ "pat-0842", "pat-0618" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 61, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "b44a6c9762bb8aafd531cdef326509ca", "payload_hash": "c9209c422508513f875ebf7c10e40a62", "path_pattern_hash": "846b3460b625ad1b1254c9016233442b" }, "target_context": { "dst_port": 2083, "service": "http", "service_name": "http", "risk_score": 61 }, "payload_preview": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36\r\nAccept-Encod", "method": "POST", "path": "\/login\/", "query_string": "login_only=1", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "waf_tags": [ "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "POST \/login\/?login_only=1 HTTP\/1.1", "request_sample": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: close\r\nHost: 62.3.50.33:2083\r\nContent-Length: 20\r\nContent-Type: application\/x-w", "payload_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36\r\nAccept-Encod", "evidence": { "method": "POST", "path": "\/login\/", "query_string": "login_only=1", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "waf_tags": [ "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "POST \/login\/?login_only=1 HTTP\/1.1", "request_sample": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: close\r\nHost: 62.3.50.33:2083\r\nContent-Length: 20\r\nContent-Type: application\/x-w", "payload_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36\r\nAccept-Encod", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "76bc875e467c69dc0ed5a138766e5af41b52ba2f", "protocol_details": { "http_method": "POST", "http_path": "\/login\/", "request_line": "POST \/login\/?login_only=1 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "port": 2083, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36\r\nAccept-Encod", "attack_vector": "http smuggling probe \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login\/", "target_port_label": "2083 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 61, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 61, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/login\/", "request_line": "POST \/login\/?login_only=1 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36", "port": 2083, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login\/", "evidence_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36\r\nAccept-Encod", "target_port_label": "2083 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_login", "net_web_probe" ] }
21/06/2026 11:09:02 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload ��xY�� ?6{#�"/ �WH��`�k~ ��7��f��×��nN)f@{J��ܑ��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��xY��?6{#�"/ �WH��`�k~ ��7��f��×��nN)f@{J��ܑ��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��xY�� ?6{#�"/ �WH��`�k~ ��7��f��×��nN)f@{J��ܑ��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 1674, "payload_entropy": 7.630047890155051, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "007c6efc40255d7005b68e94c6a91c36", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003x\u0000Y\ufffd\ufffd\ufffd\u000b?6\u0007{#\ufffd\"\/\n\u0014\ufffdWH\ufffd\ufffd\ufffd`\u0017\ufffd\u0010k~\f \ufffd\ufffd7\ufffd\ufffd\ufffdf\u001a\ufffd\ufffd\u00d7\ufffd\ufffdnN)f\ue1ee@{J\ufffd\u0007\ufffd\u0711\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003x\u0000Y\ufffd\ufffd\ufffd\u000b?6\u0007{#\ufffd\"\/\n\u0014\ufffdWH\ufffd\ufffd\ufffd`\u0017\ufffd\u0010k~\f \ufffd\ufffd7\ufffd\ufffd\ufffdf\u001a\ufffd\ufffd\u00d7\ufffd\ufffdnN)f\ue1ee@{J\ufffd\u0007\ufffd\u0711\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003x\u0000Y\ufffd\ufffd\ufffd\u000b?6\u0007{#\ufffd\"\/\n\u0014\ufffdWH\ufffd\ufffd\ufffd`\u0017\ufffd\u0010k~\f \ufffd\ufffd7\ufffd\ufffd\ufffdf\u001a\ufffd\ufffd\u00d7\ufffd\ufffdnN)f\ue1ee@{J\ufffd\u0007\ufffd\u0711\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "0866b35532269be71a30ca0d5440d34508918556", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003x\u0000Y\ufffd\ufffd\ufffd\u000b?6\u0007{#\ufffd\"\/\n\u0014\ufffdWH\ufffd\ufffd\ufffd`\u0017\ufffd\u0010k~\f \ufffd\ufffd7\ufffd\ufffd\ufffdf\u001a\ufffd\ufffd\u00d7\ufffd\ufffdnN)f\ue1ee@{J\ufffd\u0007\ufffd\u0711\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffdxY\ufffd\ufffd\ufffd?6{#\ufffd\"\/\n\ufffdWH\ufffd\ufffd\ufffd`\ufffdk~ \ufffd\ufffd7\ufffd\ufffd\ufffdf\ufffd\ufffd\u00d7\ufffd\ufffdnN)f\ue1ee@{J\ufffd\ufffd\u0711\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003x\u0000Y\ufffd\ufffd\ufffd\u000b?6\u0007{#\ufffd\"\/\n\u0014\ufffdWH\ufffd\ufffd\ufffd`\u0017\ufffd\u0010k~\f \ufffd\ufffd7\ufffd\ufffd\ufffdf\u001a\ufffd\ufffd\u00d7\ufffd\ufffdnN)f\ue1ee@{J\ufffd\u0007\ufffd\u0711\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdxY\ufffd\ufffd\ufffd?6{#\ufffd\"\/\n\ufffdWH\ufffd\ufffd\ufffd`\ufffdk~ \ufffd\ufffd7\ufffd\ufffd\ufffdf\ufffd\ufffd\u00d7\ufffd\ufffdnN)f\ue1ee@{J\ufffd\ufffd\u0711\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }
21/06/2026 11:09:01 UTC	TCP	2083 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:2083 · (tentative d'exploit) · → /openid_connect/cpanelid	Élevée	Moyen · 50
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /openid_connect/cpanelid UA Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefo… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_admin_panel_scan Cible HTTP GET /openid_connect/cpanelid TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2083 Chemin / cible /openid_connect/cpanelid Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /openid_connect/cpanelid HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /openid_connect/cpanelid HTTP/1.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0 Accep Requête brute (extrait) GET /openid_connect/cpanelid HTTP/1.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: close Host: 62.3.50.33:2083 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "80ed50a47ad6386e110103b40770259a62aae049", "http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0", "http_target_hash": "08a3ffc0b8ecd02c42600619d8011c3bbca5791e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 216, "payload_entropy": 5.2682368423500785, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "http", "app_proto": "http", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 84, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "57aac5a0f956ed040bddaad5a37d3595248fd8c5", "event_fingerprint": "76594bf4a7df6d65afa61051e7ad9bbbba85f7d9", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 50, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "860da5fd69b9a4398718dec0e118bfe0", "payload_hash": "84c22cf81ca861239c643f546adeef21", "path_pattern_hash": "e20f1efb1757fb88ce46feb9e6081802" }, "target_context": { "dst_port": 2083, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccep", "method": "GET", "path": "\/openid_connect\/cpanelid", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1", "request_sample": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: close\r\nHost: 62.3.50.33:2083\r\n\r\n", "payload_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccep", "evidence": { "method": "GET", "path": "\/openid_connect\/cpanelid", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1", "request_sample": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: close\r\nHost: 62.3.50.33:2083\r\n\r\n", "payload_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccep", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a7b2590f7bd04e7cae65f933facaa0087b503228", "protocol_details": { "http_method": "GET", "http_path": "\/openid_connect\/cpanelid", "request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0", "port": 2083, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccep", "attack_vector": "exploit attempt \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/openid_connect\/cpanelid", "target_port_label": "2083 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 70, "confidence_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 50, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/openid_connect\/cpanelid", "request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0", "port": 2083, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/openid_connect\/cpanelid", "evidence_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccep", "target_port_label": "2083 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_admin_panel_scan", "net_web_probe" ] }
21/06/2026 11:09:01 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload ��&̙��w��qt��G �ؕ��H� QwI�� ](YZ�3�D�ja\|�O��;E��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��&̙��w��qt��G �ؕ��H� QwI�� ](YZ�3�D�ja\|�O��;E��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��&̙��w��qt��G �ؕ��H� QwI�� ](YZ�3�D�ja\|�O��;E��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 837, "payload_entropy": 7.146504098236008, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "05908525922b60244f9b4c2f2a27d391", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd&\u0319\ufffd\ufffd\ufffd\ufffd\u0015w\ufffd\ufffdqt\ufffd\ufffd\ufffd\ufffd\ufffdG\u000e\n\ufffd\u0615\ufffd\ufffdH\ufffd QwI\ufffd\ufffd\n](YZ\ufffd3\ufffd\u0011\u001bD\ufffdja\|\ufffd\u0000O\ufffd\ufffd;E\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd&\u0319\ufffd\ufffd\ufffd\ufffd\u0015w\ufffd\ufffdqt\ufffd\ufffd\ufffd\ufffd\ufffdG\u000e\n\ufffd\u0615\ufffd\ufffdH\ufffd QwI\ufffd\ufffd\n](YZ\ufffd3\ufffd\u0011\u001bD\ufffdja\|\ufffd\u0000O\ufffd\ufffd;E\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd&\u0319\ufffd\ufffd\ufffd\ufffd\u0015w\ufffd\ufffdqt\ufffd\ufffd\ufffd\ufffd\ufffdG\u000e\n\ufffd\u0615\ufffd\ufffdH\ufffd QwI\ufffd\ufffd\n](YZ\ufffd3\ufffd\u0011\u001bD\ufffdja\|\ufffd\u0000O\ufffd\ufffd;E\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c3b3aa26462ee6180b6f9e81d74861f15bb70670", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd&\u0319\ufffd\ufffd\ufffd\ufffd\u0015w\ufffd\ufffdqt\ufffd\ufffd\ufffd\ufffd\ufffdG\u000e\n\ufffd\u0615\ufffd\ufffdH\ufffd QwI\ufffd\ufffd\n](YZ\ufffd3\ufffd\u0011\u001bD\ufffdja\|\ufffd\u0000O\ufffd\ufffd;E\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd&\u0319\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffdqt\ufffd\ufffd\ufffd\ufffd\ufffdG\n\ufffd\u0615\ufffd\ufffdH\ufffd QwI\ufffd\ufffd\n](YZ\ufffd3\ufffdD\ufffdja\|\ufffdO\ufffd\ufffd;E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd&\u0319\ufffd\ufffd\ufffd\ufffd\u0015w\ufffd\ufffdqt\ufffd\ufffd\ufffd\ufffd\ufffdG\u000e\n\ufffd\u0615\ufffd\ufffdH\ufffd QwI\ufffd\ufffd\n](YZ\ufffd3\ufffd\u0011\u001bD\ufffdja\|\ufffd\u0000O\ufffd\ufffd;E\ufffd\ufffd\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd&\u0319\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffdqt\ufffd\ufffd\ufffd\ufffd\ufffdG\n\ufffd\u0615\ufffd\ufffdH\ufffd QwI\ufffd\ufffd\n](YZ\ufffd3\ufffdD\ufffdja\|\ufffdO\ufffd\ufffd;E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }
21/06/2026 11:08:59 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload ��4�7;��a�tv��<�$�8� e��^ �H�6��!8�/l��r�}�=T�2�!R>��/��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��4�7;��a�tv��<�$�8� e��^ �H�6��!8�/l��r�}�=T�2�!R>��/��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��4�7;��a�tv��<�$�8� e��^ �H�6��!8�/l��r�}�=T�2�!R>��/��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 837, "payload_entropy": 7.126412732563295, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "858d0b4ef5a6f4863530cc26d6e3bd8f", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u00034\ufffd7;\ufffd\ufffd\ufffd\ufffd\ufffd\u0001a\ufffdtv\ufffd\ufffd<\ufffd$\ufffd\u00188\ufffd\ne\ufffd\u000f\ufffd\u0019\ufffd^ \ufffd\u000e\u001dH\ufffd6\ufffd\ufffd!8\ufffd\/l\ufffd\ufffdr\ufffd}\ufffd=\u001bT\ufffd2\ufffd!R>\ufffd\ufffd\/\u001e\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u00034\ufffd7;\ufffd\ufffd\ufffd\ufffd\ufffd\u0001a\ufffdtv\ufffd\ufffd<\ufffd$\ufffd\u00188\ufffd\ne\ufffd\u000f\ufffd\u0019\ufffd^ \ufffd\u000e\u001dH\ufffd6\ufffd\ufffd!8\ufffd\/l\ufffd\ufffdr\ufffd}\ufffd=\u001bT\ufffd2\ufffd!R>\ufffd\ufffd\/\u001e\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u00034\ufffd7;\ufffd\ufffd\ufffd\ufffd\ufffd\u0001a\ufffdtv\ufffd\ufffd<\ufffd$\ufffd\u00188\ufffd\ne\ufffd\u000f\ufffd\u0019\ufffd^ \ufffd\u000e\u001dH\ufffd6\ufffd\ufffd!8\ufffd\/l\ufffd\ufffdr\ufffd}\ufffd=\u001bT\ufffd2\ufffd!R>\ufffd\ufffd\/\u001e\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "49f640c647877094dfb774a4ef18fa2acd651948", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u00034\ufffd7;\ufffd\ufffd\ufffd\ufffd\ufffd\u0001a\ufffdtv\ufffd\ufffd<\ufffd$\ufffd\u00188\ufffd\ne\ufffd\u000f\ufffd\u0019\ufffd^ \ufffd\u000e\u001dH\ufffd6\ufffd\ufffd!8\ufffd\/l\ufffd\ufffdr\ufffd}\ufffd=\u001bT\ufffd2\ufffd!R>\ufffd\ufffd\/\u001e\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffd4\ufffd7;\ufffd\ufffd\ufffd\ufffd\ufffda\ufffdtv\ufffd\ufffd<\ufffd$\ufffd8\ufffd\ne\ufffd\ufffd\ufffd^ \ufffdH\ufffd6\ufffd\ufffd!8\ufffd\/l\ufffd\ufffdr\ufffd}\ufffd=T\ufffd2\ufffd!R>\ufffd\ufffd\/\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u00034\ufffd7;\ufffd\ufffd\ufffd\ufffd\ufffd\u0001a\ufffdtv\ufffd\ufffd<\ufffd$\ufffd\u00188\ufffd\ne\ufffd\u000f\ufffd\u0019\ufffd^ \ufffd\u000e\u001dH\ufffd6\ufffd\ufffd!8\ufffd\/l\ufffd\ufffdr\ufffd}\ufffd=\u001bT\ufffd2\ufffd!R>\ufffd\ufffd\/\u001e\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd4\ufffd7;\ufffd\ufffd\ufffd\ufffd\ufffda\ufffdtv\ufffd\ufffd<\ufffd$\ufffd8\ufffd\ne\ufffd\ufffd\ufffd^ \ufffdH\ufffd6\ufffd\ufffd!8\ufffd\/l\ufffd\ufffdr\ufffd}\ufffd=T\ufffd2\ufffd!R>\ufffd\ufffd\/\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }
21/06/2026 11:08:58 UTC	TCP	2083 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:2083 · (tentative d'exploit) · → /json-api/version	Élevée	Moyen · 49
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /json-api/version UA Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefo… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 net_web_probe Cible HTTP GET /json-api/version TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2083 Chemin / cible /json-api/version Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 49 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /json-api/version HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /json-api/version HTTP/1.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0 Accept-Encod Requête brute (extrait) GET /json-api/version HTTP/1.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: close Host: 62.3.50.33:2083 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "80ed50a47ad6386e110103b40770259a62aae049", "http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0", "http_target_hash": "14c280d02fe10fe8f17466531c9f78784af4a03a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 209, "payload_entropy": 5.318150070158627, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "http", "app_proto": "http", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 84, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.4, "risk_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 49, "tag_count": 4, "anomaly_count": 0, "campaign_key": "341ac2e411800b1811620dc2f6102cfc7d8f5a48", "event_fingerprint": "ffa523eedaf882831d5605c3607b35820c8c071b", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 49, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "860da5fd69b9a4398718dec0e118bfe0", "payload_hash": "7182bc17b73fbb3f649d216a463f0cba", "path_pattern_hash": "ef958d6b0a9ba431c8e46338947b4b72" }, "target_context": { "dst_port": 2083, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET \/json-api\/version HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encod", "method": "GET", "path": "\/json-api\/version", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/json-api\/version HTTP\/1.1", "request_sample": "GET \/json-api\/version HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: close\r\nHost: 62.3.50.33:2083\r\n\r\n", "payload_snippet": "GET \/json-api\/version HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encod", "evidence": { "method": "GET", "path": "\/json-api\/version", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/json-api\/version HTTP\/1.1", "request_sample": "GET \/json-api\/version HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: close\r\nHost: 62.3.50.33:2083\r\n\r\n", "payload_snippet": "GET \/json-api\/version HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encod", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "98dbb4db302fe5371b204ffb24e966179fe532a0", "protocol_details": { "http_method": "GET", "http_path": "\/json-api\/version", "request_line": "GET \/json-api\/version HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0", "port": 2083, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/json-api\/version HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encod", "attack_vector": "exploit attempt \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/json-api\/version", "target_port_label": "2083 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 70, "confidence_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 49, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/json-api\/version", "request_line": "GET \/json-api\/version HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0", "port": 2083, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/json-api\/version", "evidence_snippet": "GET \/json-api\/version HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encod", "target_port_label": "2083 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "net_web_probe" ] }
21/06/2026 11:08:58 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload ��L� � ��ZJ��rN��B�i�Q�y�� U�,�BΠ ��<B��H��QM��<�Ic��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification :* Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��L� � ��ZJ��rN��B�i�Q�y�� U�,�BΠ ��<B��H��QM��<�Ic��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��L� � ��ZJ��rN��B�i�Q�y�� U�,�BΠ ��<B��H��QM��<�Ic��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 837, "payload_entropy": 7.120413161971455, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "c144bebb2faaae6ff09abc2dc3cacf44", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003L\ufffd \u000e\ufffd\uf8e5\n\ufffd\ufffdZJ\ufffd\ufffd\ufffdrN\ufffd\ufffd\u0007B\ufffdi\ufffdQ\ufffdy\ufffd\u0001\ufffd\u0012 U\ufffd,\ufffdB\u03a0 \ufffd\ufffd<B\ufffd\ufffd\ufffdH\ufffd\u001c\ufffd\u0007\ufffdQM\ufffd\ufffd<\ufffdIc\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003L\ufffd \u000e\ufffd\uf8e5\n\ufffd\ufffdZJ\ufffd\ufffd\ufffdrN\ufffd\ufffd\u0007B\ufffdi\ufffdQ\ufffdy\ufffd\u0001\ufffd\u0012 U\ufffd,\ufffdB\u03a0 \ufffd\ufffd<B\ufffd\ufffd\ufffdH\ufffd\u001c\ufffd\u0007\ufffdQM\ufffd\ufffd<\ufffdIc\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003L\ufffd \u000e\ufffd\uf8e5\n\ufffd\ufffdZJ\ufffd\ufffd\ufffdrN\ufffd\ufffd\u0007B\ufffdi\ufffdQ\ufffdy\ufffd\u0001\ufffd\u0012 U\ufffd,\ufffdB\u03a0 \ufffd\ufffd<B\ufffd\ufffd\ufffdH\ufffd\u001c\ufffd\u0007\ufffdQM\ufffd\ufffd<\ufffdIc\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9d15d0c2cb1e5a306197320c5401985651fa2561", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003L\ufffd \u000e\ufffd\uf8e5\n\ufffd\ufffdZJ\ufffd\ufffd\ufffdrN\ufffd\ufffd\u0007B\ufffdi\ufffdQ\ufffdy\ufffd\u0001\ufffd\u0012 U\ufffd,\ufffdB\u03a0 \ufffd\ufffd<B\ufffd\ufffd\ufffdH\ufffd\u001c\ufffd\u0007\ufffdQM\ufffd\ufffd<\ufffdIc\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffdL\ufffd \ufffd\uf8e5\n\ufffd\ufffdZJ\ufffd\ufffd\ufffdrN\ufffd\ufffdB\ufffdi\ufffdQ\ufffdy\ufffd\ufffd U\ufffd,\ufffdB\u03a0 \ufffd\ufffd<B\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffdQM\ufffd\ufffd<\ufffdIc\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003L\ufffd \u000e\ufffd\uf8e5\n\ufffd\ufffdZJ\ufffd\ufffd\ufffdrN\ufffd\ufffd\u0007B\ufffdi\ufffdQ\ufffdy\ufffd\u0001\ufffd\u0012 U\ufffd,\ufffdB\u03a0 \ufffd\ufffd<B\ufffd\ufffd\ufffdH\ufffd\u001c\ufffd\u0007\ufffdQM\ufffd\ufffd<\ufffdIc\ufffd\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdL\ufffd \ufffd\uf8e5\n\ufffd\ufffdZJ\ufffd\ufffd\ufffdrN\ufffd\ufffdB\ufffdi\ufffdQ\ufffdy\ufffd\ufffd U\ufffd,\ufffdB\u03a0 *\ufffd\ufffd<B\ufffd\ufffd\ufffdH\ufffd\ufffd\ufffdQM\ufffd\ufffd<\ufffdIc\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }
21/06/2026 11:08:57 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload ��@�1�4�k�!��{�Z�Vǥkﱒ� Dq�n� �sX�(} ��i��ެ�> E��Ic\6� ��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��@�1�4�k�!��{�Z�Vǥkﱒ� Dq�n� �sX�(}��i��ެ�> E��Ic\6� ��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��@�1�4�k�!��{�Z�Vǥkﱒ� Dq�n� �sX�(} ��i��ެ�> E��Ic\6� ��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 837, "payload_entropy": 7.116140434028737, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "5c748ba521d414065de5b0a2f320f433", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003@\ufffd1\ufffd4\ufffdk\ufffd!\ufffd\ufffd\u001f\ufffd{\ufffdZ\ufffdV\u01e5k\ufc52\ufffd\u000b Dq\ufffdn\ufffd \ufffdsX\ufffd(}\f\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\u07ac\ufffd>\rE\ufffd\ufffd\ufffdIc\\6\ufffd\r\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003@\ufffd1\ufffd4\ufffdk\ufffd!\ufffd\ufffd\u001f\ufffd{\ufffdZ\ufffdV\u01e5k\ufc52\ufffd\u000b Dq\ufffdn\ufffd \ufffdsX\ufffd(}\f\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\u07ac\ufffd>\rE\ufffd\ufffd\ufffdIc\\6\ufffd\r\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003@\ufffd1\ufffd4\ufffdk\ufffd!\ufffd\ufffd\u001f\ufffd{\ufffdZ\ufffdV\u01e5k\ufc52\ufffd\u000b Dq\ufffdn\ufffd \ufffdsX\ufffd(}\f\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\u07ac\ufffd>\rE\ufffd\ufffd\ufffdIc\\6\ufffd\r\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9da8cd488429b376f4db1f56893a45f3c0086ce1", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003@\ufffd1\ufffd4\ufffdk\ufffd!\ufffd\ufffd\u001f\ufffd{\ufffdZ\ufffdV\u01e5k\ufc52\ufffd\u000b Dq\ufffdn\ufffd \ufffdsX\ufffd(}\f\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\u07ac\ufffd>\rE\ufffd\ufffd\ufffdIc\\6\ufffd\r\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffd@\ufffd1\ufffd4\ufffdk\ufffd!\ufffd\ufffd\ufffd{\ufffdZ\ufffdV\u01e5k\ufc52\ufffd Dq\ufffdn\ufffd \ufffdsX\ufffd(}\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\u07ac\ufffd>\rE\ufffd\ufffd\ufffdIc\\6\ufffd\r\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003@\ufffd1\ufffd4\ufffdk\ufffd!\ufffd\ufffd\u001f\ufffd{\ufffdZ\ufffdV\u01e5k\ufc52\ufffd\u000b Dq\ufffdn\ufffd \ufffdsX\ufffd(}\f\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\u07ac\ufffd>\rE\ufffd\ufffd\ufffdIc\\6\ufffd\r\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd@\ufffd1\ufffd4\ufffdk\ufffd!\ufffd\ufffd\ufffd{\ufffdZ\ufffdV\u01e5k\ufc52\ufffd Dq\ufffdn\ufffd \ufffdsX\ufffd(}\ufffd\ufffd\ufffdi\ufffd\ufffd\ufffd\ufffd\u07ac\ufffd>\rE\ufffd\ufffd\ufffdIc\\6\ufffd\r\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }
21/06/2026 11:06:16 UTC	TCP	2083 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:2083 · (tentative d'exploit) · → /login/	Élevée	Moyen · 61
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /login/ UA Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefo… Émulateur HTTP WAF 26 Recommandation Investiguer Tags 950326:rce-0 950327:rce-0 950468:nosqli-3 950470:nosqli-3 Cible HTTP POST /login/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 2083 Chemin / cible /login/ Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 61 Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL cPanel login path Ligne de requête `POST /login/ HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0 Règles WAF rce-0 nosqli-3 Payload (extrait) POST /login/ HTTP/1.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0 Accept-Encoding: gzip Requête brute (extrait) POST /login/ HTTP/1.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: close Host: 62.3.50.33:2083 Content-Length: 20 Content-Type: application/x-www-form-u Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "http_header_count": 7, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "80ed50a47ad6386e110103b40770259a62aae049", "http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0", "http_target_hash": "beca565932dffc1fab4432c056fac7fc3acb1027", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 289, "payload_entropy": 5.376655184123234, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "http", "app_proto": "http", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 3.1, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 61, "tag_count": 6, "anomaly_count": 0, "campaign_key": "aa298d089beef2127dc3d35f6f4565999e78dba5", "event_fingerprint": "3becd45d28fa9f137b157644048d4c7391dce156", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0618" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "cPanel login path" ], "pattern_ids": [ "pat-0842", "pat-0618" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 61, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "860da5fd69b9a4398718dec0e118bfe0", "payload_hash": "2a32e92d2b03da770717be17f8bf4870", "path_pattern_hash": "846b3460b625ad1b1254c9016233442b" }, "target_context": { "dst_port": 2083, "service": "http", "service_name": "http", "risk_score": 61 }, "payload_preview": "POST \/login\/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encoding: gzip", "method": "POST", "path": "\/login\/", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0", "waf_tags": [ "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "POST \/login\/ HTTP\/1.1", "request_sample": "POST \/login\/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: close\r\nHost: 62.3.50.33:2083\r\nContent-Length: 20\r\nContent-Type: application\/x-www-form-u", "payload_snippet": "POST \/login\/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encoding: gzip", "evidence": { "method": "POST", "path": "\/login\/", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0", "waf_tags": [ "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "POST \/login\/ HTTP\/1.1", "request_sample": "POST \/login\/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: close\r\nHost: 62.3.50.33:2083\r\nContent-Length: 20\r\nContent-Type: application\/x-www-form-u", "payload_snippet": "POST \/login\/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encoding: gzip", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f931022cad0c327b0b44b946a06d9cf5cf753717", "protocol_details": { "http_method": "POST", "http_path": "\/login\/", "request_line": "POST \/login\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0", "port": 2083, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/login\/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encoding: gzip", "attack_vector": "http smuggling probe \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login\/", "target_port_label": "2083 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 61, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 61, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/login\/", "request_line": "POST \/login\/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0", "port": 2083, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login\/", "evidence_snippet": "POST \/login\/ HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encoding: gzip", "target_port_label": "2083 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950327:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_login", "net_web_probe" ] }
21/06/2026 11:06:15 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload ��e`�:\|�Ip1��8m�'-Z�J6:B`,q �RG�~�o��S��% �9�:$�c��o��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification :* Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��e`�:\|�Ip1��8m�'-Z�J6:B`,q �RG�~�o��S��% �9�:$�c��o��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��e`�:\|�Ip1��8m�'-Z�J6:B`,q �RG�~�o��S��% �9�:$�c��o��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 837, "payload_entropy": 7.087041902313519, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4f6e84857a28cf14d249019f2623c6a7", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003e`\ufffd:\|\ufffdI\u001ap1\ufffd\ufffd8m\u0018\ufffd'\u001d-Z\ufffd\u001cJ6:B`,\u0002\u0011q\u0019 \ufffdRG\ufffd~\ufffdo\ufffd\ufffdS\ufffd\ufffd\ufffd% \ufffd9\u0010\ufffd\u001f:$\ufffdc\ufffd\u000e\ufffdo\ufffd\ufffd\u0010\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003e`\ufffd:\|\ufffdI\u001ap1\ufffd\ufffd8m\u0018\ufffd'\u001d-Z\ufffd\u001cJ6:B`,\u0002\u0011q\u0019 \ufffdRG\ufffd~\ufffdo\ufffd\ufffdS\ufffd\ufffd\ufffd% \ufffd9\u0010\ufffd\u001f:$\ufffdc\ufffd\u000e\ufffdo\ufffd\ufffd\u0010\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003e`\ufffd:\|\ufffdI\u001ap1\ufffd\ufffd8m\u0018\ufffd'\u001d-Z\ufffd\u001cJ6:B`,\u0002\u0011q\u0019 \ufffdRG\ufffd~\ufffdo\ufffd\ufffdS\ufffd\ufffd\ufffd% \ufffd9\u0010\ufffd\u001f:$\ufffdc\ufffd\u000e\ufffdo\ufffd\ufffd\u0010\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "24490bfde02f11e4a3011eae3c6d7503564ab19a", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003e`\ufffd:\|\ufffdI\u001ap1\ufffd\ufffd8m\u0018\ufffd'\u001d-Z\ufffd\u001cJ6:B`,\u0002\u0011q\u0019 \ufffdRG\ufffd~\ufffdo\ufffd\ufffdS\ufffd\ufffd\ufffd% \ufffd9\u0010\ufffd\u001f:$\ufffdc\ufffd\u000e\ufffdo\ufffd\ufffd\u0010\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffde`\ufffd:\|\ufffdIp1\ufffd\ufffd8m\ufffd'-Z\ufffdJ6:B`,q \ufffdRG\ufffd~\ufffdo\ufffd\ufffdS\ufffd\ufffd\ufffd% \ufffd9\ufffd:$\ufffdc\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003e`\ufffd:\|\ufffdI\u001ap1\ufffd\ufffd8m\u0018\ufffd'\u001d-Z\ufffd\u001cJ6:B`,\u0002\u0011q\u0019 \ufffdRG\ufffd~\ufffdo\ufffd\ufffdS\ufffd\ufffd\ufffd% \ufffd9\u0010\ufffd\u001f:$\ufffdc\ufffd\u000e\ufffdo\ufffd\ufffd\u0010\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffde`\ufffd:\|\ufffdIp1\ufffd\ufffd8m\ufffd'-Z\ufffdJ6:B`,q \ufffdRG\ufffd~\ufffdo*\ufffd\ufffdS\ufffd\ufffd\ufffd% \ufffd9\ufffd:$\ufffdc\ufffd\ufffdo\ufffd\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }
21/06/2026 11:06:15 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload ��m��u��B�2��3T^w�w/��a�H� U��˽�C�vjd�O��,��S�6�pOg��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��m��u��B�2��3T^w�w/��a�H� U��˽�C�vjd�O��,��S�6�pOg��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��m��u��B�2��3T^w�w/��a�H� U��˽�C�vjd�O��,��S�6�pOg��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 837, "payload_entropy": 7.131135924412683, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7efea0e1d24eaf949be9f8cafcee8438", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffdm\u0000\ufffd\ufffdu\ufffd\ufffd\ufffdB\u0004\u0018\ufffd2\ufffd\ufffd\ufffd3T^w\u0001\ufffdw\/\ufffd\b\ufffda\ufffdH\ufffd U\ufffd\ufffd\u0017\u02fd\ufffdC\ufffdvjd\u0002\u0019\ufffdO\ufffd\u0018\ufffd,\u0003\ufffd\ufffd\ufffd\ufffdS\ufffd6\ufffdpOg\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffdm\u0000\ufffd\ufffdu\ufffd\ufffd\ufffdB\u0004\u0018\ufffd2\ufffd\ufffd\ufffd3T^w\u0001\ufffdw\/\ufffd\b\ufffda\ufffdH\ufffd U\ufffd\ufffd\u0017\u02fd\ufffdC\ufffdvjd\u0002\u0019\ufffdO\ufffd\u0018\ufffd,\u0003\ufffd\ufffd\ufffd\ufffdS\ufffd6\ufffdpOg\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffdm\u0000\ufffd\ufffdu\ufffd\ufffd\ufffdB\u0004\u0018\ufffd2\ufffd\ufffd\ufffd3T^w\u0001\ufffdw\/\ufffd\b\ufffda\ufffdH\ufffd U\ufffd\ufffd\u0017\u02fd\ufffdC\ufffdvjd\u0002\u0019\ufffdO\ufffd\u0018\ufffd,\u0003\ufffd\ufffd\ufffd\ufffdS\ufffd6\ufffdpOg\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "64faa4fd29d5e203bbaec2b841d01ecc17b33668", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffdm\u0000\ufffd\ufffdu\ufffd\ufffd\ufffdB\u0004\u0018\ufffd2\ufffd\ufffd\ufffd3T^w\u0001\ufffdw\/\ufffd\b\ufffda\ufffdH\ufffd U\ufffd\ufffd\u0017\u02fd\ufffdC\ufffdvjd\u0002\u0019\ufffdO\ufffd\u0018\ufffd,\u0003\ufffd\ufffd\ufffd\ufffdS\ufffd6\ufffdpOg\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffd\ufffdm\ufffd\ufffdu\ufffd\ufffd\ufffdB\ufffd2\ufffd\ufffd\ufffd3T^w\ufffdw\/\ufffd\ufffda\ufffdH\ufffd U\ufffd\ufffd\u02fd\ufffdC\ufffdvjd\ufffdO\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffdS\ufffd6\ufffdpOg\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffdm\u0000\ufffd\ufffdu\ufffd\ufffd\ufffdB\u0004\u0018\ufffd2\ufffd\ufffd\ufffd3T^w\u0001\ufffdw\/\ufffd\b\ufffda\ufffdH\ufffd U\ufffd\ufffd\u0017\u02fd\ufffdC\ufffdvjd\u0002\u0019\ufffdO\ufffd\u0018\ufffd,\u0003\ufffd\ufffd\ufffd\ufffdS\ufffd6\ufffdpOg\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffdm\ufffd\ufffdu\ufffd\ufffd\ufffdB\ufffd2\ufffd\ufffd\ufffd3T^w\ufffdw\/\ufffd\ufffda\ufffdH\ufffd U\ufffd\ufffd\u02fd\ufffdC\ufffdvjd\ufffdO\ufffd\ufffd,\ufffd\ufffd\ufffd\ufffdS\ufffd6\ufffdpOg\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }
21/06/2026 11:06:14 UTC	TCP	2083 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:2083 · (tentative d'exploit) · → /login/	Élevée	Moyen · 56
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole POST /login/ UA Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_probe_login Cible HTTP POST /login/ TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 2083 Chemin / cible /login/ Service HTTP Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95% Confiance classification 100% Corrélation +8 Risque capteur Moyen · 56 Confiance : Confiance 95 % — Motif catalogue confirmé · 3 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL cPanel login path Ligne de requête `POST /login/?login_only=1 HTTP/1.1` User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0 Règles WAF rce-0 nosqli-3 Payload (extrait) POST /login/?login_only=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0 Requête brute (extrait) POST /login/?login_only=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: close Host: 62.3.50.33:2083 Content-Length: 20 Content-Type: a Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "http_header_count": 7, "http_query_params": 1, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "b34d153dbd2c170b15fb01dfadbb894c4e81abaf", "http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0", "http_target_hash": "8867d3379ac5bf62897f1378b18a6965af39ff3a", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 292, "payload_entropy": 5.3558901810561155, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "http", "app_proto": "http", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 84, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 84, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 56, "tag_count": 5, "anomaly_count": 0, "campaign_key": "80accde2440dc5be7c7767645a5469a9f132a118", "event_fingerprint": "d525a5e9fc19a0376430a62d72689974824b6ddc", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "confidence": 1, "classification_confidence": 1, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0618" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "cPanel login path" ], "pattern_ids": [ "pat-0842", "pat-0618" ], "confidence_breakdown": { "waf": 84, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 56, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "8c3dcbb12b0adbf722cf2d35dfa4069d", "payload_hash": "48497edd38753d650f96469ef8a09299", "path_pattern_hash": "846b3460b625ad1b1254c9016233442b" }, "target_context": { "dst_port": 2083, "service": "http", "service_name": "http", "risk_score": 56 }, "payload_preview": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0", "method": "POST", "path": "\/login\/", "query_string": "login_only=1", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "POST \/login\/?login_only=1 HTTP\/1.1", "request_sample": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: close\r\nHost: 62.3.50.33:2083\r\nContent-Length: 20\r\nContent-Type: a", "payload_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0", "evidence": { "method": "POST", "path": "\/login\/", "query_string": "login_only=1", "user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "POST \/login\/?login_only=1 HTTP\/1.1", "request_sample": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: close\r\nHost: 62.3.50.33:2083\r\nContent-Length: 20\r\nContent-Type: a", "payload_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0", "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "2241e8f958d399b2b12794d74fa7ff25e2cab888", "protocol_details": { "http_method": "POST", "http_path": "\/login\/", "request_line": "POST \/login\/?login_only=1 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0", "port": 2083, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0", "attack_vector": "http smuggling probe \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login\/", "target_port_label": "2083 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 56\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 100, "confidence_breakdown": { "waf": 84, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 56, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 56, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "POST", "http_path": "\/login\/", "request_line": "POST \/login\/?login_only=1 HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0", "port": 2083, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login\/", "evidence_snippet": "POST \/login\/?login_only=1 HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko\/20100101 Firefox\/126.0", "target_port_label": "2083 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF", "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_probe_login", "net_web_probe" ] }
21/06/2026 11:06:12 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload ��r�� ڦwb̈@�Cʿ,þ��F)P� ��^�yhoXV.��;�ƕ�Eq�L�!I,z��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��r�� ڦwb̈@�Cʿ,þ��F)P� ��^�yhoXV.��;�ƕ�Eq�L�!I,z��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��r�� ڦwb̈@�Cʿ,þ��F)P� ��^�yhoXV.��;�ƕ�Eq�L�!I,z��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 1674, "payload_entropy": 7.614560212853626, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "dae53acfeaf900779eb7ad5b755f3d24", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003r\ufffd\ufffd\ufffd\u0013\r\u06a6w\u0005b\u0308\u0003@\ufffdC\u02bf,\u00fe\ufffd\ufffd\u0015\ufffd\ufffd\ufffdF)P\ufffd \ufffd\ufffd^\u0016\ufffd\u001byhoX\u0014V.\ufffd\ufffd\ufffd\ufffd;\ufffd\u0195\ufffdEq\ufffdL\ufffd!I,z\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003r\ufffd\ufffd\ufffd\u0013\r\u06a6w\u0005b\u0308\u0003@\ufffdC\u02bf,\u00fe\ufffd\ufffd\u0015\ufffd\ufffd\ufffdF)P\ufffd \ufffd\ufffd^\u0016\ufffd\u001byhoX\u0014V.\ufffd\ufffd\ufffd\ufffd;\ufffd\u0195\ufffdEq\ufffdL\ufffd!I,z\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003r\ufffd\ufffd\ufffd\u0013\r\u06a6w\u0005b\u0308\u0003@\ufffdC\u02bf,\u00fe\ufffd\ufffd\u0015\ufffd\ufffd\ufffdF)P\ufffd \ufffd\ufffd^\u0016\ufffd\u001byhoX\u0014V.\ufffd\ufffd\ufffd\ufffd;\ufffd\u0195\ufffdEq\ufffdL\ufffd!I,z\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "db50ca08e792a7e5832ccb8598f84432c1dff098", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003r\ufffd\ufffd\ufffd\u0013\r\u06a6w\u0005b\u0308\u0003@\ufffdC\u02bf,\u00fe\ufffd\ufffd\u0015\ufffd\ufffd\ufffdF)P\ufffd \ufffd\ufffd^\u0016\ufffd\u001byhoX\u0014V.\ufffd\ufffd\ufffd\ufffd;\ufffd\u0195\ufffdEq\ufffdL\ufffd!I,z\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffdr\ufffd\ufffd\ufffd\r\u06a6wb\u0308@\ufffdC\u02bf,\u00fe\ufffd\ufffd\ufffd\ufffd\ufffdF)P\ufffd \ufffd\ufffd^\ufffdyhoXV.\ufffd\ufffd\ufffd\ufffd;\ufffd\u0195\ufffdEq\ufffdL\ufffd!I,z\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003r\ufffd\ufffd\ufffd\u0013\r\u06a6w\u0005b\u0308\u0003@\ufffdC\u02bf,\u00fe\ufffd\ufffd\u0015\ufffd\ufffd\ufffdF)P\ufffd \ufffd\ufffd^\u0016\ufffd\u001byhoX\u0014V.\ufffd\ufffd\ufffd\ufffd;\ufffd\u0195\ufffdEq\ufffdL\ufffd!I,z\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdr\ufffd\ufffd\ufffd\r\u06a6wb\u0308@\ufffdC\u02bf,\u00fe\ufffd\ufffd\ufffd\ufffd\ufffdF)P\ufffd \ufffd\ufffd^\ufffdyhoXV.\ufffd\ufffd\ufffd\ufffd;\ufffd\u0195\ufffdEq\ufffdL\ufffd!I,z\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }
21/06/2026 11:06:11 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload ��҂ai�ɯB3:��`�ڜQݝOT@��(V�� 7`u�Zp �K��W�})�M?�;\|��7 ��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��҂ai�ɯB3:��`�ڜQݝOT@��(V�� 7`u�Zp�K��W�})�M?�;\|��7��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��҂ai�ɯB3:��`�ڜQݝOT@��(V�� 7`u�Zp �K��W�})�M?�;\|��7 ��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 837, "payload_entropy": 7.115626304218388, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "7b15b1bd2394291fd336ce036fd58877", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0482ai\ufffd\u026fB3\u0017:\ufffd\ufffd`\ufffd\u069cQ\u075dO\u0007T@\ufffd\ufffd(V\ufffd\ufffd\ufffd\ufffd 7`u\ufffdZ\u0000p\u000b\ufffdK\ufffd\u0017\ufffd\ufffdW\u0000\ufffd})\ufffd\u0003\u0011M?\ufffd;\|\ufffd\ufffd7\u0005\f\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0482ai\ufffd\u026fB3\u0017:\ufffd\ufffd`\ufffd\u069cQ\u075dO\u0007T@\ufffd\ufffd(V\ufffd\ufffd\ufffd\ufffd 7`u\ufffdZ\u0000p\u000b\ufffdK\ufffd\u0017\ufffd\ufffdW\u0000\ufffd})\ufffd\u0003\u0011M?\ufffd;\|\ufffd\ufffd7\u0005\f\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0482ai\ufffd\u026fB3\u0017:\ufffd\ufffd`\ufffd\u069cQ\u075dO\u0007T@\ufffd\ufffd(V\ufffd\ufffd\ufffd\ufffd 7`u\ufffdZ\u0000p\u000b\ufffdK\ufffd\u0017\ufffd\ufffdW\u0000\ufffd})\ufffd\u0003\u0011M?\ufffd;\|\ufffd\ufffd7\u0005\f\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "8342c32354803881f57b21a8db19054bb71e5f87", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0482ai\ufffd\u026fB3\u0017:\ufffd\ufffd`\ufffd\u069cQ\u075dO\u0007T@\ufffd\ufffd(V\ufffd\ufffd\ufffd\ufffd 7`u\ufffdZ\u0000p\u000b\ufffdK\ufffd\u0017\ufffd\ufffdW\u0000\ufffd})\ufffd\u0003\u0011M?\ufffd;\|\ufffd\ufffd7\u0005\f\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffd\u0482ai\ufffd\u026fB3:\ufffd\ufffd`\ufffd\u069cQ\u075dOT@\ufffd\ufffd(V\ufffd\ufffd\ufffd\ufffd 7`u\ufffdZp\ufffdK\ufffd\ufffd\ufffdW\ufffd})\ufffdM?\ufffd;\|\ufffd\ufffd7\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0482ai\ufffd\u026fB3\u0017:\ufffd\ufffd`\ufffd\u069cQ\u075dO\u0007T@\ufffd\ufffd(V\ufffd\ufffd\ufffd\ufffd 7`u\ufffdZ\u0000p\u000b\ufffdK\ufffd\u0017\ufffd\ufffdW\u0000\ufffd})\ufffd\u0003\u0011M?\ufffd;\|\ufffd\ufffd7\u0005\f\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u0482ai\ufffd\u026fB3:\ufffd\ufffd`\ufffd\u069cQ\u075dOT@\ufffd\ufffd(V\ufffd\ufffd\ufffd\ufffd 7`u\ufffdZp\ufffdK\ufffd\ufffd\ufffdW\ufffd})\ufffdM?\ufffd;\|\ufffd\ufffd7\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }
21/06/2026 11:06:10 UTC	TCP	2083 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:2083 · (tentative d'exploit) · → /openid_connect/cpanelid	Élevée	Moyen · 50
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /openid_connect/cpanelid UA Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefo… Émulateur HTTP WAF 19 Recommandation Investiguer Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 http_admin_panel_scan Cible HTTP GET /openid_connect/cpanelid TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2083 Chemin / cible /openid_connect/cpanelid Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 50 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /openid_connect/cpanelid HTTP/1.1` User-Agent Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /openid_connect/cpanelid HTTP/1.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0 Accep Requête brute (extrait) GET /openid_connect/cpanelid HTTP/1.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0 Accept-Encoding: gzip, deflate, br Accept: / Connection: close Host: 62.3.50.33:2083 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "80ed50a47ad6386e110103b40770259a62aae049", "http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0", "http_target_hash": "08a3ffc0b8ecd02c42600619d8011c3bbca5791e", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 216, "payload_entropy": 5.2682368423500785, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "http", "app_proto": "http", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 84, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 0, "risk_granularity": 2.7, "risk_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 50, "tag_count": 5, "anomaly_count": 0, "campaign_key": "57aac5a0f956ed040bddaad5a37d3595248fd8c5", "event_fingerprint": "76594bf4a7df6d65afa61051e7ad9bbbba85f7d9", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 50, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "860da5fd69b9a4398718dec0e118bfe0", "payload_hash": "84c22cf81ca861239c643f546adeef21", "path_pattern_hash": "e20f1efb1757fb88ce46feb9e6081802" }, "target_context": { "dst_port": 2083, "service": "http", "service_name": "http", "risk_score": 50 }, "payload_preview": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccep", "method": "GET", "path": "\/openid_connect\/cpanelid", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1", "request_sample": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: close\r\nHost: 62.3.50.33:2083\r\n\r\n", "payload_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccep", "evidence": { "method": "GET", "path": "\/openid_connect\/cpanelid", "user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1", "request_sample": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: close\r\nHost: 62.3.50.33:2083\r\n\r\n", "payload_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccep", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "a7b2590f7bd04e7cae65f933facaa0087b503228", "protocol_details": { "http_method": "GET", "http_path": "\/openid_connect\/cpanelid", "request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0", "port": 2083, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccep", "attack_vector": "exploit attempt \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/openid_connect\/cpanelid", "target_port_label": "2083 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 70, "confidence_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 50, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 50, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/openid_connect\/cpanelid", "request_line": "GET \/openid_connect\/cpanelid HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0", "port": 2083, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/openid_connect\/cpanelid", "evidence_snippet": "GET \/openid_connect\/cpanelid HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64; rv:125.0) Gecko\/20100101 Firefox\/125.0\r\nAccep", "target_port_label": "2083 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_investigate", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "http_admin_panel_scan", "net_web_probe" ] }
21/06/2026 11:06:08 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload ��ř�/��h{�o&�-�_��u�p��rRh،\|�� C��>O�!�^��9��\|�3��gX,hoHC��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��ř�/��h{�o&�-�_��u�p��rRh،\|�� C��>O�!�^��9��\|�3��gX,hoHC��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��ř�/��h{�o&�-�_��u�p��rRh،\|�� C��>O�!�^��9��\|�3��gX,hoHC��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 1674, "payload_entropy": 7.612220326847037, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "e372ea7a5eb3b15352295b36f50f6718", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0159\ufffd\u0000\/\ufffd\ufffdh{\ufffdo&\ufffd-\ufffd_\ufffd\ufffdu\ufffdp\ufffd\ufffd\ufffdrRh\u060c\|\ufffd\ufffd C\ufffd\ufffd\ufffd\ufffd>O\ufffd!\ufffd^\ufffd\ufffd9\ufffd\ufffd\|\ufffd3\ufffd\ufffd\ufffdgX,ho\u001eH\bC\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0159\ufffd\u0000\/\ufffd\ufffdh{\ufffdo&\ufffd-\ufffd_\ufffd\ufffdu\ufffdp\ufffd\ufffd\ufffdrRh\u060c\|\ufffd\ufffd C\ufffd\ufffd\ufffd\ufffd>O\ufffd!\ufffd^\ufffd\ufffd9\ufffd\ufffd\|\ufffd3\ufffd\ufffd\ufffdgX,ho\u001eH\bC\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0159\ufffd\u0000\/\ufffd\ufffdh{\ufffdo&\ufffd-\ufffd_\ufffd\ufffdu\ufffdp\ufffd\ufffd\ufffdrRh\u060c\|\ufffd\ufffd C\ufffd\ufffd\ufffd\ufffd>O\ufffd!\ufffd^\ufffd\ufffd9\ufffd\ufffd\|\ufffd3\ufffd\ufffd\ufffdgX,ho\u001eH\bC\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "fa1f3dd7ad4b49fd81004bde665a694050c60ad2", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0159\ufffd\u0000\/\ufffd\ufffdh{\ufffdo&\ufffd-\ufffd_\ufffd\ufffdu\ufffdp\ufffd\ufffd\ufffdrRh\u060c\|\ufffd\ufffd C\ufffd\ufffd\ufffd\ufffd>O\ufffd!\ufffd^\ufffd\ufffd9\ufffd\ufffd\|\ufffd3\ufffd\ufffd\ufffdgX,ho\u001eH\bC\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffd\u0159\ufffd\/\ufffd\ufffdh{\ufffdo&\ufffd-\ufffd_\ufffd\ufffdu\ufffdp\ufffd\ufffd\ufffdrRh\u060c\|\ufffd\ufffd C\ufffd\ufffd\ufffd\ufffd>O\ufffd!\ufffd^\ufffd\ufffd9\ufffd\ufffd\|\ufffd3\ufffd\ufffd\ufffdgX,hoHC\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0159\ufffd\u0000\/\ufffd\ufffdh{\ufffdo&\ufffd-\ufffd_\ufffd\ufffdu\ufffdp\ufffd\ufffd\ufffdrRh\u060c\|\ufffd\ufffd C\ufffd\ufffd\ufffd\ufffd>O\ufffd!\ufffd^\ufffd\ufffd9\ufffd\ufffd\|\ufffd3\ufffd\ufffd\ufffdgX,ho\u001eH\bC\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u0159\ufffd\/\ufffd\ufffdh{\ufffdo&\ufffd-\ufffd_\ufffd\ufffdu\ufffdp\ufffd\ufffd\ufffdrRh\u060c\|\ufffd\ufffd C\ufffd\ufffd\ufffd\ufffd>O\ufffd!\ufffd^\ufffd\ufffd9\ufffd\ufffd\|\ufffd3\ufffd\ufffd\ufffdgX,hoHC\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }
21/06/2026 11:06:07 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload �� s �=N][��Wi駟"ȴ�ʉ ��t�rB.��M�2�G��/��@$�r_� ��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 58% Corrélation +8 Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �� s �=N][��Wi駟"ȴ�ʉ ��t�rB.��M�2�G��/��@$�r_��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) �� s �=N][��Wi駟"ȴ�ʉ ��t�rB.��M�2�G��/��@$�r_� ��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 1674, "payload_entropy": 7.614051513316044, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.58, "confidence": 0.58, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "0050fd0fb136793dae36ffc49431ef33", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0016 \ufffd\u0019\u0017\ufffd\ufffd\ufffds \ufffd=\u0005N][\u0017\ufffd\ufffd\ufffdWi\u99df\"\u0234\ufffd\u0289 \ufffd\ufffdt\ufffdr\u0012B.\ufffd\ufffdM\ufffd2\ufffdG\ufffd\ufffd\ufffd\u0004\/\ufffd\ufffd\u0018@$\ufffdr_\ufffd\f\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0016 \ufffd\u0019\u0017\ufffd\ufffd\ufffds \ufffd=\u0005N][\u0017\ufffd\ufffd\ufffdWi\u99df\"\u0234\ufffd\u0289 \ufffd\ufffdt\ufffdr\u0012B.\ufffd\ufffdM\ufffd2\ufffdG\ufffd\ufffd\ufffd\u0004\/\ufffd\ufffd\u0018@$\ufffdr_\ufffd\f\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0016 \ufffd\u0019\u0017\ufffd\ufffd\ufffds \ufffd=\u0005N][\u0017\ufffd\ufffd\ufffdWi\u99df\"\u0234\ufffd\u0289 \ufffd\ufffdt\ufffdr\u0012B.\ufffd\ufffdM\ufffd2\ufffdG\ufffd\ufffd\ufffd\u0004\/\ufffd\ufffd\u0018@$\ufffdr_\ufffd\f\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "323b0644e366978dd1f588f1afad2eb3a75f8281", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0016 \ufffd\u0019\u0017\ufffd\ufffd\ufffds \ufffd=\u0005N][\u0017\ufffd\ufffd\ufffdWi\u99df\"\u0234\ufffd\u0289 \ufffd\ufffdt\ufffdr\u0012B.\ufffd\ufffdM\ufffd2\ufffdG\ufffd\ufffd\ufffd\u0004\/\ufffd\ufffd\u0018@$\ufffdr_\ufffd\f\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffd \ufffd\ufffd\ufffd\ufffds \ufffd=N][\ufffd\ufffd\ufffdWi\u99df\"\u0234\ufffd\u0289 \ufffd\ufffdt\ufffdrB.\ufffd\ufffdM\ufffd2\ufffdG\ufffd\ufffd\ufffd\/\ufffd\ufffd@$\ufffdr_\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 58, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45, "correlation_boost": 8 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u0016 \ufffd\u0019\u0017\ufffd\ufffd\ufffds \ufffd=\u0005N][\u0017\ufffd\ufffd\ufffdWi\u99df\"\u0234\ufffd\u0289 \ufffd\ufffdt\ufffdr\u0012B.\ufffd\ufffdM\ufffd2\ufffdG\ufffd\ufffd\ufffd\u0004\/\ufffd\ufffd\u0018@$\ufffdr_\ufffd\f\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd \ufffd\ufffd\ufffd\ufffds \ufffd=N][\ufffd\ufffd\ufffdWi\u99df\"\u0234\ufffd\u0289 \ufffd\ufffdt\ufffdrB.\ufffd\ufffdM\ufffd2\ufffdG\ufffd\ufffd\ufffd\/\ufffd\ufffd@$\ufffdr_\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }
21/06/2026 11:06:06 UTC	TCP	2083 · HTTP	http	Tentative d'exploit exploit attempt · via HTTP:2083 · (tentative d'exploit) · → /json-api/version	Élevée	Moyen · 49
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces Corrélations Multi-protocole corrélé (5 min) MITRE TA0001 TA0001 TA0002 Protocole GET /json-api/version UA Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537… Émulateur HTTP WAF 19 Recommandation Surveiller Tags 950326:rce-0 950468:nosqli-3 950470:nosqli-3 net_web_probe Cible HTTP GET /json-api/version TLS SNI — Capteur paris-1
Preuve / Evidence Méthode GET Port 2083 Chemin / cible /json-api/version Service HTTP Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62% Confiance classification 70% Corrélation +8 Risque capteur Moyen · 49 Confiance : Confiance 62 % — 3 tag(s) WAF Protocole émulé 1 Signaux MITRE-T1190 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Ligne de requête `GET /json-api/version HTTP/1.1` User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Règles WAF rce-0 nosqli-3 Payload (extrait) GET /json-api/version HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Geck Requête brute (extrait) GET /json-api/version HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept: / Connection: close Host: 62.3.50.33:2083 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "http_header_count": 5, "http_query_params": 0, "http_path_depth": 2, "http_path_ext": null, "http_ua_hash": "a26828f24e275c0e9b8355efa10cb23927e66b27", "http_host_hash": "ea42ecbc54c9c495a92c7dd11f2463e9f5b9ede0", "http_target_hash": "14c280d02fe10fe8f17466531c9f78784af4a03a", "http_referer_hash": null, "http_method": "GET", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 256, "payload_entropy": 5.386319386018325, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "http", "app_proto": "http", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 84, "risk_classification": 72, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 33, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2.4, "risk_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15 }, "risk_score": 49, "tag_count": 4, "anomaly_count": 0, "campaign_key": "341ac2e411800b1811620dc2f6102cfc7d8f5a48", "event_fingerprint": "ffa523eedaf882831d5605c3607b35820c8c071b", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "confidence": 0.7, "classification_confidence": 0.7, "precision_score": 73, "precision_signals": [ "MITRE-T1190" ], "kb_rule_ids": [ "MITRE-T1190" ], "confidence_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 49, "correlation_boost": 8 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 62, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "0ae74ebdade6a927c4cc2e84d3c9f8aa", "payload_hash": "f6ba15814f405989cffb43bb47e2ada5", "path_pattern_hash": "ef958d6b0a9ba431c8e46338947b4b72" }, "target_context": { "dst_port": 2083, "service": "http", "service_name": "http", "risk_score": 49 }, "payload_preview": "GET \/json-api\/version HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Geck", "method": "GET", "path": "\/json-api\/version", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/json-api\/version HTTP\/1.1", "request_sample": "GET \/json-api\/version HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: close\r\nHost: 62.3.50.33:2083\r\n\r\n", "payload_snippet": "GET \/json-api\/version HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Geck", "evidence": { "method": "GET", "path": "\/json-api\/version", "user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36", "waf_tags": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3" ], "waf_rule_names": [ "rce-0", "nosqli-3" ], "request_line": "GET \/json-api\/version HTTP\/1.1", "request_sample": "GET \/json-api\/version HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36\r\nAccept-Encoding: gzip, deflate, br\r\nAccept: \/\r\nConnection: close\r\nHost: 62.3.50.33:2083\r\n\r\n", "payload_snippet": "GET \/json-api\/version HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Geck", "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "unknown" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "e1f9238aa92ba133ab1ba64d9d21675edc408613", "protocol_details": { "http_method": "GET", "http_path": "\/json-api\/version", "request_line": "GET \/json-api\/version HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36", "port": 2083, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "GET \/json-api\/version HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Geck", "attack_vector": "exploit attempt \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/json-api\/version", "target_port_label": "2083 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "classification_reason_label_fr": "Tentative d'exploit (tag rce-0) \u00b7 confiance 62%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 70 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)", "confidence_pct": 70, "confidence_breakdown": { "waf": 84, "classification": 72, "behavior": 0, "geo": 0, "protocol": 33, "novelty": 15, "risk_score": 49, "correlation_boost": 8 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 49, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "MITRE-T1190" ], "tags_summary_labels_fr": [ "MITRE-T1190" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": [ "multi_protocol_correlation" ], "correlation_flags_labels_fr": [ "Multi-protocole corr\u00e9l\u00e9 (5 min)" ], "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Corr\u00e9lation +8", "protocol_details": { "http_method": "GET", "http_path": "\/json-api\/version", "request_line": "GET \/json-api\/version HTTP\/1.1", "http_user_agent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/125.0.0.0 Safari\/537.36", "port": 2083, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "exploit attempt \u00b7 via HTTP:2083 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/json-api\/version", "evidence_snippet": "GET \/json-api\/version HTTP\/1.1\r\nUser-Agent: Mozilla\/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit\/537.36 (KHTML, like Geck", "target_port_label": "2083 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 62 % \u2014 3 tag(s) WAF", "confidence_factors_fr": "Confiance 70 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +8 \u00b7 3 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "multi_protocol_correlation": true, "multi_protocol_count": 2, "multi_protocol_sample": [ "cpanel-ssl", "http" ], "multi_protocol_window_s": 300, "behavior_alerts": [ "multi_protocol_correlation" ], "correlation_confidence_boost": 8, "attack_chain_stage": "exploitation", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "950326:rce-0", "950468:nosqli-3", "950470:nosqli-3", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 96 }
21/06/2026 11:06:04 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload ��?t�A�yn��V�V� ��\G�+)�6�� @8G�38�MPih�;�d��WKbw�m��t3��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification :* Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��?t�A�yn��V�V� ��\G�+)�6�� @8G�38�MPih�;�d��WKbw�m��t3��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��?t�A�yn��V�V� ��\G�+)�6�� @8G�38�MPih�;�d��WKbw�m��t3��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 1674, "payload_entropy": 7.613833109110928, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "721c46fb0f7f11a5e07c0d70010befbb", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd?t\ufffdA\ufffdy\u0012\u0013n\ufffd\u0001\ufffd\ufffd\ufffdV\ufffdV\ufffd \ufffd\ufffd\ufffd\\G\ufffd+)\ufffd6\ufffd\ufffd @8G\u001d\u001e\ufffd38\ufffdMPih\ufffd;\u0016\ufffdd\ufffd\ufffdWKbw\ufffdm\ufffd\ufffdt3\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd?t\ufffdA\ufffdy\u0012\u0013n\ufffd\u0001\ufffd\ufffd\ufffdV\ufffdV\ufffd \ufffd\ufffd\ufffd\\G\ufffd+)\ufffd6\ufffd\ufffd @8G\u001d\u001e\ufffd38\ufffdMPih\ufffd;\u0016\ufffdd\ufffd\ufffdWKbw\ufffdm\ufffd\ufffdt3\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd?t\ufffdA\ufffdy\u0012\u0013n\ufffd\u0001\ufffd\ufffd\ufffdV\ufffdV\ufffd \ufffd\ufffd\ufffd\\G\ufffd+)\ufffd6\ufffd\ufffd @8G\u001d\u001e\ufffd38\ufffdMPih\ufffd;\u0016\ufffdd\ufffd\ufffdWKbw\ufffdm\ufffd\ufffdt3\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "61fa3cd4a1abee4cdbe0ba1edb96aa4b05d16d92", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd?t\ufffdA\ufffdy\u0012\u0013n\ufffd\u0001\ufffd\ufffd\ufffdV\ufffdV\ufffd \ufffd\ufffd\ufffd\\G\ufffd+)\ufffd6\ufffd\ufffd @8G\u001d\u001e\ufffd38\ufffdMPih\ufffd;\u0016\ufffdd\ufffd\ufffdWKbw\ufffdm\ufffd\ufffdt3\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffd\ufffd?t\ufffdA\ufffdyn\ufffd\ufffd\ufffd\ufffdV\ufffdV\ufffd \ufffd\ufffd\ufffd\\G\ufffd+)\ufffd6\ufffd\ufffd @8G\ufffd38\ufffdMPih\ufffd;\ufffdd\ufffd\ufffdWKbw\ufffdm\ufffd\ufffdt3\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd?t\ufffdA\ufffdy\u0012\u0013n\ufffd\u0001\ufffd\ufffd\ufffdV\ufffdV\ufffd \ufffd\ufffd\ufffd\\G\ufffd+)\ufffd6\ufffd\ufffd @8G\u001d\u001e\ufffd38\ufffdMPih\ufffd;\u0016\ufffdd\ufffd\ufffdWKbw\ufffdm\ufffd\ufffdt3\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd?t\ufffdA\ufffdyn\ufffd\ufffd\ufffd\ufffdV\ufffdV\ufffd \ufffd\ufffd\ufffd\\G\ufffd+)\ufffd6\ufffd\ufffd @8G\ufffd38\ufffdMPih\ufffd;\ufffdd\ufffd\ufffdWKbw\ufffdm*\ufffd\ufffdt3\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }
21/06/2026 11:06:02 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload ��"��Ѯ�`3^��t��E�;��'�,� �c�dR�q�y$�N�� y��(R��ò��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��"��Ѯ�`3^��t��E�;��'�,� �c�dR�q�y$�N�� y��(R��ò��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��"��Ѯ�`3^��t��E�;��'�,� �c�dR�q�y$�N�� y��(R��ò��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 837, "payload_entropy": 7.122972619441398, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "b2839f6371181683a2a185c571bf5269", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\"\ufffd\ufffd\ufffd\u046e\ufffd`\u00033^\ufffd\ufffdt\ufffd\ufffdE\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd,\ufffd \ufffdc\ufffd\u0000dR\ufffdq\u0015\ufffdy$\u000e\ufffdN\ufffd\ufffd \ufffd\ufffdy\ufffd\ufffd\u0018(R\ufffd\ufffd\ufffd\ufffd\u00f2\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\"\ufffd\ufffd\ufffd\u046e\ufffd`\u00033^\ufffd\ufffdt\ufffd\ufffdE\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd,\ufffd \ufffdc\ufffd\u0000dR\ufffdq\u0015\ufffdy$\u000e\ufffdN\ufffd\ufffd \ufffd\ufffdy\ufffd\ufffd\u0018(R\ufffd\ufffd\ufffd\ufffd\u00f2\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\"\ufffd\ufffd\ufffd\u046e\ufffd`\u00033^\ufffd\ufffdt\ufffd\ufffdE\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd,\ufffd \ufffdc\ufffd\u0000dR\ufffdq\u0015\ufffdy$\u000e\ufffdN\ufffd\ufffd \ufffd\ufffdy\ufffd\ufffd\u0018(R\ufffd\ufffd\ufffd\ufffd\u00f2\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "c9c668bea5efe3b4b2b12e9a21f001af5ace70bf", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\"\ufffd\ufffd\ufffd\u046e\ufffd`\u00033^\ufffd\ufffdt\ufffd\ufffdE\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd,\ufffd \ufffdc\ufffd\u0000dR\ufffdq\u0015\ufffdy$\u000e\ufffdN\ufffd\ufffd \ufffd\ufffdy\ufffd\ufffd\u0018(R\ufffd\ufffd\ufffd\ufffd\u00f2\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffd\ufffd\"\ufffd\ufffd\ufffd\u046e\ufffd`3^\ufffd\ufffdt\ufffd\ufffdE\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd,\ufffd \ufffdc\ufffddR\ufffdq\ufffdy$\ufffdN\ufffd\ufffd \ufffd\ufffdy\ufffd\ufffd(R\ufffd\ufffd\ufffd\ufffd\u00f2\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\"\ufffd\ufffd\ufffd\u046e\ufffd`\u00033^\ufffd\ufffdt\ufffd\ufffdE\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd,\ufffd \ufffdc\ufffd\u0000dR\ufffdq\u0015\ufffdy$\u000e\ufffdN\ufffd\ufffd \ufffd\ufffdy\ufffd\ufffd\u0018(R\ufffd\ufffd\ufffd\ufffd\u00f2\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\"\ufffd\ufffd\ufffd\u046e\ufffd`3^\ufffd\ufffdt\ufffd\ufffdE\ufffd;\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd'\ufffd,\ufffd \ufffdc\ufffddR\ufffdq\ufffdy$\ufffdN\ufffd\ufffd \ufffd\ufffdy\ufffd\ufffd(R\ufffd\ufffd\ufffd\ufffd\u00f2\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }
21/06/2026 10:47:36 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload �� %cwБi�fh�ҩ=r"�#��.j �6TwJR '"�U� A��Э��馵uuj��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) �� %cwБi�fh�ҩ=r"�#��.j �6TwJR'"�U�A��Э��馵uuj��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) �� %cwБi�fh�ҩ=r"�#��.j �6TwJR '"�U� A��Э��馵uuj��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 837, "payload_entropy": 7.04973450171804, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "643f7103b67dace3a27e3b313c6bd21a", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\t\ufffd%cw\u0411i\ufffdfh\ufffd\u04a9=r\"\ufffd#\ufffd\ufffd\u0010\ufffd\u0002\u000f\ufffd\ufffd\ufffd.j \u0017\ufffd6TwJR\u000b'\"\ufffdU\ufffd\u0003\fA\ufffd\ufffd\u0001\u042d\u0013\ufffd\ufffd\ufffd\u99b5uuj\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\t\ufffd%cw\u0411i\ufffdfh\ufffd\u04a9=r\"\ufffd#\ufffd\ufffd\u0010\ufffd\u0002\u000f\ufffd\ufffd\ufffd.j \u0017\ufffd6TwJR\u000b'\"\ufffdU\ufffd\u0003\fA\ufffd\ufffd\u0001\u042d\u0013\ufffd\ufffd\ufffd\u99b5uuj\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\t\ufffd%cw\u0411i\ufffdfh\ufffd\u04a9=r\"\ufffd#\ufffd\ufffd\u0010\ufffd\u0002\u000f\ufffd\ufffd\ufffd.j \u0017\ufffd6TwJR\u000b'\"\ufffdU\ufffd\u0003\fA\ufffd\ufffd\u0001\u042d\u0013\ufffd\ufffd\ufffd\u99b5uuj\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "40e9a9fcec1252a0c81af60afd3dff30b7cc07c7", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\t\ufffd%cw\u0411i\ufffdfh\ufffd\u04a9=r\"\ufffd#\ufffd\ufffd\u0010\ufffd\u0002\u000f\ufffd\ufffd\ufffd.j \u0017\ufffd6TwJR\u000b'\"\ufffdU\ufffd\u0003\fA\ufffd\ufffd\u0001\u042d\u0013\ufffd\ufffd\ufffd\u99b5uuj\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\t\ufffd%cw\u0411i\ufffdfh\ufffd\u04a9=r\"\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd.j \ufffd6TwJR'\"\ufffdU\ufffdA\ufffd\ufffd\u042d\ufffd\ufffd\ufffd\u99b5uuj\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\ufffd\ufffd\t\ufffd%cw\u0411i\ufffdfh\ufffd\u04a9=r\"\ufffd#\ufffd\ufffd\u0010\ufffd\u0002\u000f\ufffd\ufffd\ufffd.j \u0017\ufffd6TwJR\u000b'\"\ufffdU\ufffd\u0003\fA\ufffd\ufffd\u0001\u042d\u0013\ufffd\ufffd\ufffd\u99b5uuj\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\t\ufffd%cw\u0411i\ufffdfh\ufffd\u04a9=r\"\ufffd#\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd.j \ufffd6TwJR'\"\ufffdU\ufffdA\ufffd\ufffd\u042d\ufffd\ufffd\ufffd\u99b5uuj\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }
21/06/2026 10:41:27 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload ��Ҿ6~ dDk!�gʘ[BU?L��.��YH ��? ma�j6��\|�̩�s�a�-T�6�fU��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��Ҿ6~dDk!�gʘ[BU?L��.��YH ��? ma�j6��\|�̩�s�a�-T�6�fU��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��Ҿ6~ dDk!�gʘ[BU?L��.��YH ��? ma�j6��\|�̩�s�a�-T�6�fU��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 837, "payload_entropy": 7.118252568799934, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "8ebed30d6c5d872e46c15f6b07c6ca1d", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u04be6~\fdD\u001bk!\ufffdg\u0298[BU\u001e?L\ufffd\ufffd\u001d\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffdYH \ufffd\ufffd\ufffd?\r\u0019ma\ufffdj6\ufffd\ufffd\|\ufffd\u0329\u0003\ufffds\ufffda\ufffd-T\u0016\ufffd6\ufffdfU\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u04be6~\fdD\u001bk!\ufffdg\u0298[BU\u001e?L\ufffd\ufffd\u001d\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffdYH \ufffd\ufffd\ufffd?\r\u0019ma\ufffdj6\ufffd\ufffd\|\ufffd\u0329\u0003\ufffds\ufffda\ufffd-T\u0016\ufffd6\ufffdfU\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u04be6~\fdD\u001bk!\ufffdg\u0298[BU\u001e?L\ufffd\ufffd\u001d\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffdYH \ufffd\ufffd\ufffd?\r\u0019ma\ufffdj6\ufffd\ufffd\|\ufffd\u0329\u0003\ufffds\ufffda\ufffd-T\u0016\ufffd6\ufffdfU\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "cc0c71ba0d790ee73d7f2737001f0d38407fa653", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u04be6~\fdD\u001bk!\ufffdg\u0298[BU\u001e?L\ufffd\ufffd\u001d\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffdYH \ufffd\ufffd\ufffd?\r\u0019ma\ufffdj6\ufffd\ufffd\|\ufffd\u0329\u0003\ufffds\ufffda\ufffd-T\u0016\ufffd6\ufffdfU\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffd\u04be6~dDk!\ufffdg\u0298[BU?L\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffdYH \ufffd\ufffd\ufffd?\rma\ufffdj6\ufffd\ufffd\|\ufffd\u0329\ufffds\ufffda\ufffd-T\ufffd6\ufffdfU\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u04be6~\fdD\u001bk!\ufffdg\u0298[BU\u001e?L\ufffd\ufffd\u001d\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffdYH \ufffd\ufffd\ufffd?\r\u0019ma\ufffdj6\ufffd\ufffd\|\ufffd\u0329\u0003\ufffds\ufffda\ufffd-T\u0016\ufffd6\ufffdfU\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\u04be6~dDk!\ufffdg\u0298[BU?L\ufffd\ufffd\ufffd.\ufffd\ufffd\ufffd\ufffd\ufffdYH \ufffd\ufffd\ufffd?\rma\ufffdj6\ufffd\ufffd\|\ufffd\u0329\ufffds\ufffda\ufffd-T\ufffd6\ufffdfU\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }
21/06/2026 10:35:37 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload ��f\|��਌O\� L�P0J�l�?��i�Q�� Y��⇲E�[��t3��FU��1�;F�SY��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��f\|��਌O\� L�P0J�l�?��i�Q�� Y��⇲E�[��t3��FU��1�;F�SY��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��f\|��਌O\� L�P0J�l�?��i�Q�� Y��⇲E�[��t3��FU��1�;F�SY��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 1674, "payload_entropy": 7.63361278575245, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "2a08f5f4204dacbdcc47d87cb7b67df9", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003f\|\ufffd\ufffd\u001a\u0a0cO\\\ufffd\nL\ufffdP0J\ufffdl\ufffd?\ufffd\ufffd\ufffd\ufffdi\ufffdQ\ufffd\ufffd Y\ufffd\u001b\ufffd\u21f2E\ufffd[\ufffd\ufffd\ufffd\u0006\ufffdt\u00103\ufffd\ufffdFU\ufffd\ufffd1\ufffd;F\ufffdSY\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003f\|\ufffd\ufffd\u001a\u0a0cO\\\ufffd\nL\ufffdP0J\ufffdl\ufffd?\ufffd\ufffd\ufffd\ufffdi\ufffdQ\ufffd\ufffd Y\ufffd\u001b\ufffd\u21f2E\ufffd[\ufffd\ufffd\ufffd\u0006\ufffdt\u00103\ufffd\ufffdFU\ufffd\ufffd1\ufffd;F\ufffdSY\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003f\|\ufffd\ufffd\u001a\u0a0cO\\\ufffd\nL\ufffdP0J\ufffdl\ufffd?\ufffd\ufffd\ufffd\ufffdi\ufffdQ\ufffd\ufffd Y\ufffd\u001b\ufffd\u21f2E\ufffd[\ufffd\ufffd\ufffd\u0006\ufffdt\u00103\ufffd\ufffdFU\ufffd\ufffd1\ufffd;F\ufffdSY\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "21df08a27ff2a0909226d578198f65a8be6f6745", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003f\|\ufffd\ufffd\u001a\u0a0cO\\\ufffd\nL\ufffdP0J\ufffdl\ufffd?\ufffd\ufffd\ufffd\ufffdi\ufffdQ\ufffd\ufffd Y\ufffd\u001b\ufffd\u21f2E\ufffd[\ufffd\ufffd\ufffd\u0006\ufffdt\u00103\ufffd\ufffdFU\ufffd\ufffd1\ufffd;F\ufffdSY\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffdf\|\ufffd\ufffd\u0a0cO\\\ufffd\nL\ufffdP0J\ufffdl\ufffd?\ufffd\ufffd\ufffd\ufffdi\ufffdQ\ufffd\ufffd Y\ufffd\ufffd\u21f2E\ufffd[\ufffd\ufffd\ufffd\ufffdt3\ufffd\ufffdFU\ufffd\ufffd1\ufffd;F\ufffdSY\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003f\|\ufffd\ufffd\u001a\u0a0cO\\\ufffd\nL\ufffdP0J\ufffdl\ufffd?\ufffd\ufffd\ufffd\ufffdi\ufffdQ\ufffd\ufffd Y\ufffd\u001b\ufffd\u21f2E\ufffd[\ufffd\ufffd\ufffd\u0006\ufffdt\u00103\ufffd\ufffdFU\ufffd\ufffd1\ufffd;F\ufffdSY\ufffd\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffdf\|\ufffd\ufffd\u0a0cO\\\ufffd\nL\ufffdP0J\ufffdl\ufffd?\ufffd\ufffd\ufffd\ufffdi\ufffdQ\ufffd\ufffd Y\ufffd\ufffd\u21f2E\ufffd[\ufffd\ufffd\ufffd\ufffdt3\ufffd\ufffdFU\ufffd\ufffd1\ufffd;F\ufffdSY\ufffd\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }
21/06/2026 08:24:54 UTC	TCP	2083 · CPANEL SSL	cpanel-ssl	cpanel probe cpanel probe · via CPANEL SSL:2083 · (sonde / probe)	Élevée	Moyen · 45
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole Émulateur CPANEL-SSL WAF — Recommandation Surveiller Tags cpanel_ssl_emulated net_cpanel_probe tls_clienthello Cible HTTP — TLS SNI — Capteur paris-1
Preuve / Evidence Méthode — Port 2083 Chemin / cible — Service CPANEL SSL Payload ��I��q�ǂ�¢�$7��7 m�2YG \|m!��u�v�k�9,��8�O�+�8}̘��,�0��̨̩̪��]�a�W�S��+�/��\�` Pourquoi cette classification : Type « cpanel_probe » (signaux protocolaires) · confiance 50% Confiance classification 50% Confiance modérée — signal unique Risque capteur Moyen · 45 Confiance : Confiance 50 % — Motif catalogue confirmé Protocole émulé 1 Signaux pat-0554 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 User-Agent — Règles WAF — Payload (extrait) ��I��q�ǂ�¢�$7��7m�2YG \|m!��u�v�k�9,��8�O�+�8}̘��,�0��̨̩̪��]�a�W�S��+�/��\�` Requête brute (extrait) ��I��q�ǂ�¢�$7��7 m�2YG \|m!��u�v�k�9,��8�O�+�8}̘��,�0��̨̩̪��]�a�W�S��+�/��\�`�V�R��$�(kj�s�w��m��#�'g@�r�v��l�� 98��:�� 32��ED�4�F��Q��P��=�<�5�/� Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206370737276642f31312e3131300d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2033380d0a0d0a3c68746d6c3e3c626f64793e6350616e656c204c6f67696e3c2f626f64793e3c2f68746d6c3e", "emulator_response_len": 125, "bytes_in": 1674, "payload_entropy": 7.607032703183413, "port_category": "registered", "org": "PT.LEXXA DATA INDONUSA", "service": "cpanel-ssl", "app_proto": "cpanel-ssl", "asn": 139428, "country": "ID", "dst_port": 2083, "risk_waf": 8, "risk_classification": 50, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 30, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 2, "risk_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15 }, "risk_score": 45, "tag_count": 3, "anomaly_count": 0, "campaign_key": "4cc54c7fcd5f1e5ebb94393f5b67f30e90170090", "event_fingerprint": "80d2812b66b9080b0842670f25ce9d4d3386dae1", "classification_confidence": 0.5, "confidence": 0.5, "precision_signals": [ "pat-0554" ], "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45 }, "service_name": "cpanel-ssl", "risk_confidence_factor": 50, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "ID", "asn": 139428, "org": "PT.LEXXA DATA INDONUSA", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "payload_hash": "4b75e7e0b8b39b8e0d9c5789dfdbfc6f", "path_pattern_hash": "e7139612faef5d92b03716e3491ff506" }, "target_context": { "dst_port": 2083, "service": "cpanel-ssl", "service_name": "cpanel-ssl", "risk_score": 45 }, "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u001b\ufffd\ufffd\ufffd\u001e\ufffdI\ufffd\u0007\ufffdq\ufffd\u01c2\ufffd\u00a2\ufffd$7\ufffd\u000e\ufffd\ufffd7\f\u0013m\ufffd2YG \|\u0010m\ue5be!\ufffd\ufffdu\ufffdv\ufffdk\ufffd9,\ufffd\ufffd8\ufffdO\ufffd+\ufffd8}\u0318\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "evidence": { "request_sample": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u001b\ufffd\ufffd\ufffd\u001e\ufffdI\ufffd\u0007\ufffdq\ufffd\u01c2\ufffd\u00a2\ufffd$7\ufffd\u000e\ufffd\ufffd7\f\u0013m\ufffd2YG \|\u0010m\ue5be!\ufffd\ufffdu\ufffdv\ufffdk\ufffd9,\ufffd\ufffd8\ufffdO\ufffd+\ufffd8}\u0318\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`\ufffdV\ufffdR\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd$\ufffd(\u0000k\u0000j\ufffds\ufffdw\u0000\ufffd\u0000\ufffd\u0000m\u0000\ufffd\ufffd#\ufffd'\u0000g\u0000@\ufffdr\ufffdv\u0000\ufffd\u0000\ufffd\u0000l\u0000\ufffd\ufffd\n\ufffd\u0014\u00009\u00008\u0000\ufffd\u0000\ufffd\ufffd\u0019\u0000:\u0000\ufffd\ufffd\t\ufffd\u0013\u00003\u00002\u0000\ufffd\u0000\ufffd\u0000E\u0000D\ufffd\u0018\u00004\u0000\ufffd\u0000F\u0000\ufffd\ufffd\ufffd\ufffdQ\u0000\ufffd\ufffd\ufffd\ufffdP\ufffd\ufffd\ufffd\ufffd\u0000=\u0000\ufffd\u0000<\u0000\ufffd\u00005\u0000\ufffd\u0000\/\u0000\ufffd", "payload_snippet": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u001b\ufffd\ufffd\ufffd\u001e\ufffdI\ufffd\u0007\ufffdq\ufffd\u01c2\ufffd\u00a2\ufffd$7\ufffd\u000e\ufffd\ufffd7\f\u0013m\ufffd2YG \|\u0010m\ue5be!\ufffd\ufffdu\ufffdv\ufffdk\ufffd9,\ufffd\ufffd8\ufffdO\ufffd+\ufffd8}\u0318\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%" }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "enterprise_scan" ], "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "eefeb21edb2fb935cdc5a7bddb7f3c6857593732", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u001b\ufffd\ufffd\ufffd\u001e\ufffdI\ufffd\u0007\ufffdq\ufffd\u01c2\ufffd\u00a2\ufffd$7\ufffd\u000e\ufffd\ufffd7\f\u0013m\ufffd2YG \|\u0010m\ue5be!\ufffd\ufffdu\ufffdv\ufffdk\ufffd9,\ufffd\ufffd8\ufffdO\ufffd+\ufffd8}\u0318\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffdq\ufffd\u01c2\ufffd\u00a2\ufffd$7\ufffd\ufffd\ufffd7m\ufffd2YG \|m\ue5be!\ufffd\ufffdu\ufffdv\ufffdk\ufffd9,\ufffd\ufffd8\ufffdO\ufffd+\ufffd8}\u0318\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "site_display": { "classification": null, "classification_reason": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "classification_reason_label_fr": "Type \u00ab cpanel_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100", "confidence_pct": 50, "confidence_breakdown": { "waf": 8, "classification": 50, "behavior": 0, "geo": 0, "protocol": 30, "novelty": 15, "risk_score": 45 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 45, "risk_label": "Moyen", "service_name": "cpanel-ssl", "service_label_fr": "CPANEL SSL", "dst_port": 2083, "protocol_emulated": true, "tags_summary": [ "pat-0554" ], "tags_summary_labels_fr": [ "pat-0554" ], "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-cpanel-ssl", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique", "protocol_details": { "payload_preview": "\u0016\u0003\u0001\u0006\ufffd\u0001\u0000\u0006\ufffd\u0003\u0003\u001b\ufffd\ufffd\ufffd\u001e\ufffdI\ufffd\u0007\ufffdq\ufffd\u01c2\ufffd\u00a2\ufffd$7\ufffd\u000e\ufffd\ufffd7\f\u0013m\ufffd2YG \|\u0010m\ue5be!\ufffd\ufffdu\ufffdv\ufffdk\ufffd9,\ufffd\ufffd8\ufffdO\ufffd+\ufffd8}\u0318\u0000\ufffd\u0013\u0002\u0013\u0003\u0013\u0001\ufffd,\ufffd0\u0000\ufffd\u0000\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\u0000\ufffd\ufffd+\ufffd\/\u0000\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "port": 2083, "service": "cpanel-ssl", "service_label_fr": "CPANEL SSL" }, "attack_vector": "cpanel probe \u00b7 via CPANEL SSL:2083 \u00b7 (sonde \/ probe)", "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdI\ufffd\ufffdq\ufffd\u01c2\ufffd\u00a2\ufffd$7\ufffd\ufffd\ufffd7m\ufffd2YG \|m\ue5be!\ufffd\ufffdu\ufffdv\ufffdk\ufffd9,\ufffd\ufffd8\ufffdO\ufffd+\ufffd8}\u0318\ufffd\ufffd,\ufffd0\ufffd\ufffd\u0329\u0328\u032a\ufffd\ufffd\ufffd\ufffd\ufffd]\ufffda\ufffdW\ufffdS\ufffd\ufffd+\ufffd\/\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\ufffd`", "target_port_label": "2083 \u00b7 CPANEL SSL", "emulator_service": "cpanel-ssl", "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9", "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "cpanel_ssl", "service_banner": "honeypot-cpanel-ssl", "service_os": "linux", "dst_port": "2083" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "cpanel_ssl_emulated", "net_cpanel_probe", "tls_clienthello" ] }

103.144.146.55

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Activité multi-protocole

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence